CVE-2025-32950
Description
Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, attackers could manipulate the FileRef parameter to access files on the system where the Jmix application is deployed, provided the application server has the necessary permissions. This can be accomplished either by modifying the FileRef directly in the database or by supplying a harmful value in the fileRef parameter of the `/files` endpoint of the generic REST API. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website.
How to fix
- haulmont jmix_framework1.6.2, 2.4.0 or later
- io.jmix.localfs:jmix-localfs1.6.2, 2.4.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| haulmont jmix_framework | 1.0.0 ≤ v < 1.6.2, 2.0.0 ≤ v < 2.4.0 | 1.6.2, 2.4.0 |
| io.jmix.localfs:jmix-localfsMaven | 1.0.0 ≤ v < 1.6.2, 2.0.0 ≤ v < 2.4.0 | 1.6.2, 2.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.