CVE-2025-32960

Source
https://nvd.nist.gov/vuln/detail/CVE-2025-32960
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-32960.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-32960
Aliases
Related
Published
2025-04-22T18:16:00Z
Modified
2025-04-23T17:14:11.421350Z
Summary
[none]
Details

The CUBA REST API add-on performs operations on data and entities. Prior to version 7.2.7, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. This issue has been patched in version 7.2.7. A workaround is provided on the Jmix documentation website.

References

Affected packages

Git / github.com/cuba-platform/restapi

Affected ranges

Type
GIT
Repo
https://github.com/cuba-platform/restapi
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed

Affected versions

v7.*

v7.2.0
v7.2.0.BETA1
v7.2.0.BETA2
v7.2.2
v7.2.3
v7.2.5
v7.2.6