Vulnerability · Published Apr 22, 2025 · Assigned by GitHub_M
CVE-2025-32961CUBA JPA Web API Vulnerable to Cross-Site Scripting (XSS) in the /download Endpoint
Medium 6.4
In plain English
A medium-severity cross-site scripting in jpawebapi from cuba-platform. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The Cuba JPA web API enables loading and saving any entities defined in the application data model by sending simple HTTP requests. Prior to version 1.1.1, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. This issue has been patched in version 1.1.1. A workaround is provided on the Jmix documentation website.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.haulmont.addon.jpawebapi:jpawebapi-jpawebapi | 1.1.1 | GHSA-hg25-w3vg-7279 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| cuba-platform | jpawebapi | < 1.1.1 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
References
- https://github.com/cuba-platform/jpawebapi/security/advisories/GHSA-hg25-w3vg-7279 x_refsource_CONFIRM
- https://github.com/cuba-platform/jpawebapi/commit/78b837d7e2b12d0df69cef1bc6042ebf3bdaf22c x_refsource_MISC
- https://docs.jmix.io/jmix/files-vulnerabilities.html x_refsource_MISC
- https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-cuba-application x_refsource_MISC