CVE-2025-32960

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-32960
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32960.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-32960
Aliases
Related
Published
2025-04-22T17:45:53.855Z
Modified
2026-08-12T15:13:27.600288Z
Severity
  • 6.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
Summary
CUBA Generic REST API Vulnerable to Cross-Site Scripting (XSS) in the /files Endpoint
Details

The CUBA REST API add-on performs operations on data and entities. Prior to version 7.2.7, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. This issue has been patched in version 7.2.7. A workaround is provided on the Jmix documentation website.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32960.json"
}
References

Affected packages

Git / github.com/cuba-platform/restapi

Affected ranges

Type
GIT
Repo
https://github.com/cuba-platform/restapi
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b3d599f6657d7e212fdb134a61ab5e0888669eb1
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "7.2.7"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v7.*
v7.2.0
v7.2.0.BETA1
v7.2.0.BETA2
v7.2.2
v7.2.3
v7.2.5
v7.2.6

Database specific

vanir_signatures 
[
    {
        "target": {
            "function": "downloadFile",
            "file": "modules/rest-api/src/com/haulmont/addon/restapi/api/controllers/FileDownloadController.java"
        },
        "signature_type": "Function",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/cuba-platform/restapi/commit/b3d599f6657d7e212fdb134a61ab5e0888669eb1",
        "digest": {
            "function_hash": "54200476744645788036700556673148464282",
            "length": 1224.0
        },
        "id": "CVE-2025-32960-2a796838"
    },
    {
        "target": {
            "file": "modules/global/src/com/haulmont/addon/restapi/api/config/RestApiConfig.java"
        },
        "signature_type": "Line",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/cuba-platform/restapi/commit/b3d599f6657d7e212fdb134a61ab5e0888669eb1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "67182121229851448952844801850171581628",
                "254701135178457847314084078399411955844",
                "301316498773120368418498872189720552775",
                "292111146108943648242344266082789239429",
                "43116381516680375384121855875653714972",
                "225113231891697709946925762082043570377"
            ]
        },
        "id": "CVE-2025-32960-677478c9"
    },
    {
        "target": {
            "file": "modules/rest-api/src/com/haulmont/addon/restapi/api/controllers/FileDownloadController.java"
        },
        "signature_type": "Line",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/cuba-platform/restapi/commit/b3d599f6657d7e212fdb134a61ab5e0888669eb1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "254300683170600550642917213360086627492",
                "285892161726166325320276996057450211142",
                "332857588120453033035124379745475889410",
                "286549100876390447999995882015714377773",
                "2265221444674032896482196102923561914",
                "101003447775308206494314163185329705853",
                "255243430482979581250663692374347555985",
                "336034280416598264724881359193451257931",
                "172182862985667924364984343603054943426",
                "167697077608159051115525551100261317647",
                "97700280060694950511671376452218888334",
                "222623144284906587510761705433814341520",
                "10960967703388405574078425875764088791",
                "61355570620212318915422324477359043720",
                "156956546100249099853681764417798671101",
                "22095937723749975876907027910505307312",
                "159058960925332754364072282101566188078"
            ]
        },
        "id": "CVE-2025-32960-e7aed99b"
    }
]
vanir_signatures_modified 
"2026-08-12T15:13:27Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32960.json"