CVE - CVE-2025-32951

CVE-ID
CVE-2025-32951	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://docs.jmix.io/jmix/files-vulnerabilities.html URL:https://docs.jmix.io/jmix/files-vulnerabilities.html MISC:https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-jmix-application URL:https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-jmix-application MISC:https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2 URL:https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2 MISC:https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a URL:https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a MISC:https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37 URL:https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37 MISC:https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa URL:https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa MISC:https://github.com/jmix-framework/jmix/issues/3804 URL:https://github.com/jmix-framework/jmix/issues/3804 MISC:https://github.com/jmix-framework/jmix/issues/3836 URL:https://github.com/jmix-framework/jmix/issues/3836 MISC:https://github.com/jmix-framework/jmix/security/advisories/GHSA-x27v-f838-jh93 URL:https://github.com/jmix-framework/jmix/security/advisories/GHSA-x27v-f838-jh93
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20250414	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20250414)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)