{"id":"CVE-2025-32951","summary":"io.jmix.rest:jmix-rest allows XSS in the /files Endpoint of the Generic REST API","details":"Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website.","aliases":["GHSA-x27v-f838-jh93"],"modified":"2026-08-12T15:13:28.931071Z","published":"2025-04-22T17:32:23.401Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32951.json"},"references":[{"type":"WEB","url":"https://docs.jmix.io/jmix/files-vulnerabilities.html"},{"type":"WEB","url":"https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-jmix-application"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32951.json"},{"type":"ADVISORY","url":"https://github.com/jmix-framework/jmix/security/advisories/GHSA-x27v-f838-jh93"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32951"},{"type":"REPORT","url":"https://github.com/jmix-framework/jmix/issues/3804"},{"type":"REPORT","url":"https://github.com/jmix-framework/jmix/issues/3836"},{"type":"FIX","url":"https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2"},{"type":"FIX","url":"https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a"},{"type":"FIX","url":"https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37"},{"type":"FIX","url":"https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/cuba-platform/cuba","events":[{"introduced":"22685ce5d084e578f9fe70209235d3bddba9bce5"},{"fixed":"42b6c00fd0572b8e52ae31afd1babc827a3161a1"}],"database_specific":{"cpe":"cpe:2.3:a:haulmont:cuba_platform:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"6.2.0"},{"fixed":"7.2.23"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/cuba-platform/restapi","events":[{"introduced":"28c6ea075ba5561835945b73129b8eae37113e16"},{"fixed":"60fc55de808e5f1a70de8be342814b43c0553e44"}],"database_specific":{"cpe":"cpe:2.3:a:haulmont:cuba_rest_api:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"7.1.1"},{"fixed":"7.2.7"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/jmix-framework/jmix","events":[{"introduced":"4e74c686d499f122268a8321cc841b371f27efb9"},{"fixed":"79107528c363c9694f2a1f94ec4d9b891ea9d3d9"},{"introduced":"589855d1261df79199b81e955791173500e070f9"},{"fixed":"10bcf8389857343eccd4aa1595ccce0416382881"},{"fixed":"6a66aa3adb967159a30d703e80403406f4c8f7a2"},{"fixed":"c589ef4e2b25620770b8036f4ad05f1a6250cb6a"},{"fixed":"cc97e6ff974b9e7af8160fab39cc5866169daa37"},{"fixed":"f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa"}],"database_specific":{"extracted_events":[{"introduced":"1.0.0"},{"fixed":"1.6.2"},{"introduced":"2.0.0"},{"fixed":"2.4.0"}],"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:haulmont:jmix_framework:*:*:*:*:*:*:*:*"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32951.json","vanir_signatures_modified":"2026-08-12T15:13:28Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37","target":{"file":"jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorage.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["257171504550285267212676293078898244411","330252577252064265692050387820904146178","12650619012565884244224958336166979861","129596914928252030239937601749259738742","102196870620493586893219714788609534690","29550115576375924630979617626519005065","80829210826843167460847408781757785315","4075255561379606518122893872180690975","270153682905755326338333752175833973540","138185996710290724794266332406947486828","217358883921368263473167424924575254320","271004535290349167646172721381770911034","216091253615713313282810904087938490639","22007346429263149104253509633388037034","22918335145885140022717251558228717629","97362543980323843969399682271276850524","240323595645474080614129767220039917292","293583394775211298780264717788344661250","198266851708669461775492812829490156780","196165914044214810776678707306242521826","45967528027294410932168743453898414217","195489255384344317534048952551630498858","252891090057982041338947245275773802846","96032347955747614708410141219293359995","35354938372743736264646197283112825341","174600520554897195920480439443717874439"]},"id":"CVE-2025-32951-01f3e4a1","signature_type":"Line"},{"id":"CVE-2025-32951-03606b61","signature_type":"Function","signature_version":"v1","source":"https://github.com/cuba-platform/cuba/commit/42b6c00fd0572b8e52ae31afd1babc827a3161a1","target":{"file":"modules/core/src/com/haulmont/cuba/core/app/filestorage/FileStorage.java","function":"saveStream"},"deprecated":false,"digest":{"function_hash":"154094281552645561377766846870311210537","length":1480}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa","target":{"file":"jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorage.java","function":"openStream"},"deprecated":false,"digest":{"function_hash":"237488192097561257452297183120032227942","length":729},"id":"CVE-2025-32951-067f2269"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["241990925233922225142782538147660768828","64319472664298954843820160959468381720","168332195582017150056419384857399325705","132431005737998996803440318592634249148","79012308002042607670485717261388907055","203231841543963653826075079096711956903","103678118652843741152354719962469948760","197153654162788015468770501236815603860","272902662017339521664675568965516773327","4350474591627366416107298296314362336","215021478749696396316945991585395029470","185450388354206726385921661974436790271","165224556441162197129053117928633430985","59798747600465045189467767377445470000","241163969096571285519004508546979276409","85960672197704603622555610117712118698","80846150877722837524120323387718541465","117835137156639979178723087693212105913","60536431756060661774335405013376578376","117910110540241473111911991261985674026","97771013057993428048414764299475509739"]},"id":"CVE-2025-32951-0690f73f","signature_type":"Line","signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a","target":{"file":"jmix-rest/rest/src/main/java/io/jmix/rest/impl/controller/FileDownloadController.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2","target":{"file":"jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorage.java"},"deprecated":false,"digest":{"line_hashes":["81429685023829092849464465262840689166","12650619012565884244224958336166979861","129596914928252030239937601749259738742","102196870620493586893219714788609534690","29550115576375924630979617626519005065","80829210826843167460847408781757785315","244607987704971196485511354475461697152","287505075622138383138924546360257454025","138185996710290724794266332406947486828","217358883921368263473167424924575254320","201848578589535708978106588930735796503","69523479161212366579819592710099354390","22007346429263149104253509633388037034","22918335145885140022717251558228717629","97362543980323843969399682271276850524","240323595645474080614129767220039917292","293583394775211298780264717788344661250","198266851708669461775492812829490156780","196165914044214810776678707306242521826","45967528027294410932168743453898414217","195489255384344317534048952551630498858","291237610663730303610797988415085133161","252891090057982041338947245275773802846","96032347955747614708410141219293359995","35354938372743736264646197283112825341","174600520554897195920480439443717874439"],"threshold":0.9},"id":"CVE-2025-32951-1819e17b"},{"signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37","target":{"file":"jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorage.java","function":"saveStream"},"deprecated":false,"digest":{"length":1489,"function_hash":"312050956198086913287366940690889687596"},"id":"CVE-2025-32951-198455e8","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2","target":{"file":"jmix-rest/rest/src/main/java/io/jmix/rest/impl/controller/FileDownloadController.java"},"deprecated":false,"digest":{"line_hashes":["241990925233922225142782538147660768828","64319472664298954843820160959468381720","168332195582017150056419384857399325705","132431005737998996803440318592634249148","79012308002042607670485717261388907055","203231841543963653826075079096711956903","103678118652843741152354719962469948760","239360508747966428823430150290273537103","29697553461777364889302067164808960686","296539585663304255251970162957197285664","226568001056506152004928984460201954806","185450388354206726385921661974436790271","165224556441162197129053117928633430985","59798747600465045189467767377445470000","241163969096571285519004508546979276409","85960672197704603622555610117712118698","80846150877722837524120323387718541465","117835137156639979178723087693212105913","60536431756060661774335405013376578376","117910110540241473111911991261985674026","97771013057993428048414764299475509739"],"threshold":0.9},"id":"CVE-2025-32951-1d521741"},{"source":"https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa","target":{"file":"jmix-rest/rest/src/main/java/io/jmix/rest/RestProperties.java"},"deprecated":false,"digest":{"line_hashes":["29185659610122395313861316182551599948","119436868407338526164171726990700626976","56732596863387622848271761664889032846","100687685275960529984236576844682530612","55683657426558059997621378749665707871","128070580493296348325497429624999569801","93118132407902822467016282270837323983","64142084060177013999069689214690682927","108607330375568690630842167193530272458","143601983874706057949628643660203641123","19866045274388517000637112827861157674","62777374092229266011355360022044508618","267028523038001442400666070711576777571","86537435192653488410133351022916938448","197008865712442448675539927397486278047","189058080544817031185572360218574019560","103739642753878370504610518275801063764","37886385785127333521157900858077273099","5424672346043702730892678598506970832","52762115694837994875987470896107698878","338850284767634062493000214987035870556","197314703678427400962082098546842167759"],"threshold":0.9},"id":"CVE-2025-32951-279460ab","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"163214687027797466334112431517158607230","length":358},"id":"CVE-2025-32951-2ba6a463","signature_type":"Function","signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2","target":{"file":"jmix-rest/rest/src/main/java/io/jmix/rest/RestProperties.java","function":"RestProperties"}},{"deprecated":false,"digest":{"line_hashes":["13932260379203073196704883315444163311","69666815674261712627969178036570725708","293451950211830567027807347306658154928","10037119209135023776777496697266592252","223948463021109568288025534070578722639","242449441993541853620220015725318120213","253233936483156682921607132573067125011","89073504890973492284087840584182765851","120241825339634219405356938809822259303","73537917116907822675211993185235386030"],"threshold":0.9},"id":"CVE-2025-32951-34523557","signature_type":"Line","signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a","target":{"file":"jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorageProperties.java"}},{"source":"https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a","target":{"file":"jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorage.java","function":"openStream"},"deprecated":false,"digest":{"function_hash":"237488192097561257452297183120032227942","length":729},"id":"CVE-2025-32951-35023616","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"295386357095718959976635158240553379034","length":462},"id":"CVE-2025-32951-424d5e89","signature_type":"Function","signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a","target":{"file":"jmix-rest/rest/src/main/java/io/jmix/rest/impl/controller/FileDownloadController.java","function":"downloadFile"}},{"signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa","target":{"file":"jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorageProperties.java"},"deprecated":false,"digest":{"line_hashes":["243621013984633556091059891848285181179","246785585224457197296282353151658786624","71725855537484191423639673854242857400","137945141263070845544368171411948494334","10037119209135023776777496697266592252","223948463021109568288025534070578722639","242449441993541853620220015725318120213","253233936483156682921607132573067125011","89073504890973492284087840584182765851","120241825339634219405356938809822259303","73537917116907822675211993185235386030"],"threshold":0.9},"id":"CVE-2025-32951-5311a5f2","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"163214687027797466334112431517158607230","length":358},"id":"CVE-2025-32951-54c1339a","signature_type":"Function","signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa","target":{"file":"jmix-rest/rest/src/main/java/io/jmix/rest/RestProperties.java","function":"RestProperties"}},{"target":{"file":"jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorage.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["257171504550285267212676293078898244411","330252577252064265692050387820904146178","12650619012565884244224958336166979861","129596914928252030239937601749259738742","102196870620493586893219714788609534690","29550115576375924630979617626519005065","80829210826843167460847408781757785315","4075255561379606518122893872180690975","270153682905755326338333752175833973540","138185996710290724794266332406947486828","217358883921368263473167424924575254320","271004535290349167646172721381770911034","216091253615713313282810904087938490639","22007346429263149104253509633388037034","22918335145885140022717251558228717629","97362543980323843969399682271276850524","240323595645474080614129767220039917292","293583394775211298780264717788344661250","198266851708669461775492812829490156780","196165914044214810776678707306242521826","45967528027294410932168743453898414217","195489255384344317534048952551630498858","252891090057982041338947245275773802846","96032347955747614708410141219293359995","35354938372743736264646197283112825341","174600520554897195920480439443717874439"]},"id":"CVE-2025-32951-5d87810d","signature_type":"Line","signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a"},{"signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2","target":{"file":"jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorage.java","function":"saveStream"},"deprecated":false,"digest":{"function_hash":"312050956198086913287366940690889687596","length":1489},"id":"CVE-2025-32951-5d8a49dc","signature_type":"Function"},{"digest":{"length":729,"function_hash":"237488192097561257452297183120032227942"},"id":"CVE-2025-32951-6570c3f5","signature_type":"Function","signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37","target":{"file":"jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorage.java","function":"openStream"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2","target":{"file":"jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorageProperties.java"},"deprecated":false,"digest":{"line_hashes":["243621013984633556091059891848285181179","246785585224457197296282353151658786624","71725855537484191423639673854242857400","137945141263070845544368171411948494334","10037119209135023776777496697266592252","223948463021109568288025534070578722639","242449441993541853620220015725318120213","253233936483156682921607132573067125011","89073504890973492284087840584182765851","120241825339634219405356938809822259303","73537917116907822675211993185235386030"],"threshold":0.9},"id":"CVE-2025-32951-684891bb"},{"signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2","target":{"function":"openStream","file":"jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorage.java"},"deprecated":false,"digest":{"function_hash":"237488192097561257452297183120032227942","length":729},"id":"CVE-2025-32951-6c7bbf9a","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37","target":{"function":"RestProperties","file":"jmix-rest/rest/src/main/java/io/jmix/rest/RestProperties.java"},"deprecated":false,"digest":{"function_hash":"42785535343495046610402840128147299419","length":298},"id":"CVE-2025-32951-795ebc8b","signature_type":"Function"},{"id":"CVE-2025-32951-7b8e7041","signature_type":"Line","signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa","target":{"file":"jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorage.java"},"deprecated":false,"digest":{"line_hashes":["81429685023829092849464465262840689166","12650619012565884244224958336166979861","129596914928252030239937601749259738742","102196870620493586893219714788609534690","29550115576375924630979617626519005065","80829210826843167460847408781757785315","244607987704971196485511354475461697152","287505075622138383138924546360257454025","138185996710290724794266332406947486828","217358883921368263473167424924575254320","201848578589535708978106588930735796503","69523479161212366579819592710099354390","22007346429263149104253509633388037034","22918335145885140022717251558228717629","97362543980323843969399682271276850524","240323595645474080614129767220039917292","293583394775211298780264717788344661250","198266851708669461775492812829490156780","196165914044214810776678707306242521826","45967528027294410932168743453898414217","195489255384344317534048952551630498858","291237610663730303610797988415085133161","252891090057982041338947245275773802846","96032347955747614708410141219293359995","35354938372743736264646197283112825341","174600520554897195920480439443717874439"],"threshold":0.9}},{"id":"CVE-2025-32951-83f9d368","signature_type":"Function","signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a","target":{"file":"jmix-rest/rest/src/main/java/io/jmix/rest/RestProperties.java","function":"RestProperties"},"deprecated":false,"digest":{"function_hash":"42785535343495046610402840128147299419","length":298}},{"source":"https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a","target":{"file":"jmix-rest/rest/src/main/java/io/jmix/rest/RestProperties.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["117162296588913963192368785038390624568","307634261829362565021699109295626487122","196410445464845262661405074631952134675","120049243697650972740132314177496527555","128070580493296348325497429624999569801","198580463888025138106743828579571251842","301145081542719358368817073716020993005","301427142021224102750427708011992741204","19866045274388517000637112827861157674","262341276278426797078287369172075852027","269214936570555792287275253079834983838","89565200698860100190898665717407457897","189058080544817031185572360218574019560","103739642753878370504610518275801063764","37886385785127333521157900858077273099","5424672346043702730892678598506970832","17849502913531087632679325642094119449","323383003213751167692917648624716845922","197314703678427400962082098546842167759"]},"id":"CVE-2025-32951-8f9c2cd9","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["241990925233922225142782538147660768828","64319472664298954843820160959468381720","168332195582017150056419384857399325705","132431005737998996803440318592634249148","79012308002042607670485717261388907055","203231841543963653826075079096711956903","103678118652843741152354719962469948760","197153654162788015468770501236815603860","272902662017339521664675568965516773327","4350474591627366416107298296314362336","215021478749696396316945991585395029470","185450388354206726385921661974436790271","165224556441162197129053117928633430985","59798747600465045189467767377445470000","241163969096571285519004508546979276409","85960672197704603622555610117712118698","80846150877722837524120323387718541465","117835137156639979178723087693212105913","60536431756060661774335405013376578376","117910110540241473111911991261985674026","97771013057993428048414764299475509739"],"threshold":0.9},"id":"CVE-2025-32951-9a5dc2fa","signature_type":"Line","signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37","target":{"file":"jmix-rest/rest/src/main/java/io/jmix/rest/impl/controller/FileDownloadController.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37","target":{"file":"jmix-rest/rest/src/main/java/io/jmix/rest/RestProperties.java"},"deprecated":false,"digest":{"line_hashes":["117162296588913963192368785038390624568","307634261829362565021699109295626487122","196410445464845262661405074631952134675","120049243697650972740132314177496527555","128070580493296348325497429624999569801","198580463888025138106743828579571251842","301145081542719358368817073716020993005","301427142021224102750427708011992741204","19866045274388517000637112827861157674","262341276278426797078287369172075852027","269214936570555792287275253079834983838","89565200698860100190898665717407457897","189058080544817031185572360218574019560","103739642753878370504610518275801063764","37886385785127333521157900858077273099","5424672346043702730892678598506970832","17849502913531087632679325642094119449","323383003213751167692917648624716845922","197314703678427400962082098546842167759"],"threshold":0.9},"id":"CVE-2025-32951-9af713f4"},{"deprecated":false,"digest":{"line_hashes":["85516700792758930825590373984692801643","110038988501292467352891284695743981511","240740207134093667813046071575955070107","190201739922301247280384152234658188356","153953561482474271954095220872426115230","318283804821084998643334262971990067035","93889483484373201680576286636251137988","160878521615346697613443191163184051177","79937744922200117699829157182311109448","55085444238556529549131815020773098873","260700480681005811560909012912728624057","265000308277612675308238222873266213696","76127233378353261750961425865708810780"],"threshold":0.9},"id":"CVE-2025-32951-9bf1e190","signature_type":"Line","signature_version":"v1","source":"https://github.com/cuba-platform/cuba/commit/42b6c00fd0572b8e52ae31afd1babc827a3161a1","target":{"file":"modules/core/src/com/haulmont/cuba/core/app/ServerConfig.java"}},{"deprecated":false,"digest":{"line_hashes":["29185659610122395313861316182551599948","119436868407338526164171726990700626976","56732596863387622848271761664889032846","100687685275960529984236576844682530612","55683657426558059997621378749665707871","128070580493296348325497429624999569801","93118132407902822467016282270837323983","64142084060177013999069689214690682927","108607330375568690630842167193530272458","143601983874706057949628643660203641123","19866045274388517000637112827861157674","62777374092229266011355360022044508618","267028523038001442400666070711576777571","86537435192653488410133351022916938448","197008865712442448675539927397486278047","189058080544817031185572360218574019560","103739642753878370504610518275801063764","37886385785127333521157900858077273099","5424672346043702730892678598506970832","52762115694837994875987470896107698878","338850284767634062493000214987035870556","197314703678427400962082098546842167759"],"threshold":0.9},"id":"CVE-2025-32951-a3bd6a43","signature_type":"Line","signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2","target":{"file":"jmix-rest/rest/src/main/java/io/jmix/rest/RestProperties.java"}},{"id":"CVE-2025-32951-a91835e8","signature_type":"Line","signature_version":"v1","source":"https://github.com/cuba-platform/cuba/commit/42b6c00fd0572b8e52ae31afd1babc827a3161a1","target":{"file":"modules/core/src/com/haulmont/cuba/core/app/filestorage/FileStorage.java"},"deprecated":false,"digest":{"line_hashes":["105377438641820252801035230913176238884","109320632837622641046056041512613162667","20925278502916451922664718368765028707","201169683846923176807712341669348993805","113851231452732460528306130170237831865","142781833362797574576531627533472138945","282438525334130075113529403023544374302","176189880099362834086192505201080294328"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2","target":{"file":"jmix-rest/rest/src/main/java/io/jmix/rest/impl/controller/FileDownloadController.java","function":"downloadFile"},"deprecated":false,"digest":{"function_hash":"295386357095718959976635158240553379034","length":462},"id":"CVE-2025-32951-af8c8d7a","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa","target":{"file":"jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorage.java","function":"saveStream"},"deprecated":false,"digest":{"function_hash":"312050956198086913287366940690889687596","length":1489},"id":"CVE-2025-32951-b1f16392"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37","target":{"function":"downloadFile","file":"jmix-rest/rest/src/main/java/io/jmix/rest/impl/controller/FileDownloadController.java"},"deprecated":false,"digest":{"function_hash":"295386357095718959976635158240553379034","length":462},"id":"CVE-2025-32951-b5dcaa6f"},{"target":{"function":"saveStream","file":"jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorage.java"},"deprecated":false,"digest":{"function_hash":"312050956198086913287366940690889687596","length":1489},"id":"CVE-2025-32951-dc848ff5","signature_type":"Function","signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a"},{"digest":{"line_hashes":["13932260379203073196704883315444163311","69666815674261712627969178036570725708","293451950211830567027807347306658154928","10037119209135023776777496697266592252","223948463021109568288025534070578722639","242449441993541853620220015725318120213","253233936483156682921607132573067125011","89073504890973492284087840584182765851","120241825339634219405356938809822259303","73537917116907822675211993185235386030"],"threshold":0.9},"id":"CVE-2025-32951-eacc120d","signature_type":"Line","signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37","target":{"file":"jmix-localfs/localfs/src/main/java/io/jmix/localfs/LocalFileStorageProperties.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"295386357095718959976635158240553379034","length":462},"id":"CVE-2025-32951-f33ed286","signature_type":"Function","signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa","target":{"file":"jmix-rest/rest/src/main/java/io/jmix/rest/impl/controller/FileDownloadController.java","function":"downloadFile"}},{"target":{"file":"jmix-rest/rest/src/main/java/io/jmix/rest/impl/controller/FileDownloadController.java"},"deprecated":false,"digest":{"line_hashes":["241990925233922225142782538147660768828","64319472664298954843820160959468381720","168332195582017150056419384857399325705","132431005737998996803440318592634249148","79012308002042607670485717261388907055","203231841543963653826075079096711956903","103678118652843741152354719962469948760","239360508747966428823430150290273537103","29697553461777364889302067164808960686","296539585663304255251970162957197285664","226568001056506152004928984460201954806","185450388354206726385921661974436790271","165224556441162197129053117928633430985","59798747600465045189467767377445470000","241163969096571285519004508546979276409","85960672197704603622555610117712118698","80846150877722837524120323387718541465","117835137156639979178723087693212105913","60536431756060661774335405013376578376","117910110540241473111911991261985674026","97771013057993428048414764299475509739"],"threshold":0.9},"id":"CVE-2025-32951-fcaaa24a","signature_type":"Line","signature_version":"v1","source":"https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}]}