CVE-2025-32951
Description
Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website.
How to fix
- haulmont jmix_framework1.6.2, 2.4.0 or later
- haulmont cuba_platform7.2.23 or later
- haulmont cuba_rest_api7.2.7 or later
- haulmont jpa_web_api1.1.1 or later
- io.jmix.rest:jmix-rest1.6.2, 2.4.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| haulmont jmix_framework | 1.0.0 ≤ v < 1.6.2, 2.0.0 ≤ v < 2.4.0 | 1.6.2, 2.4.0 |
| haulmont cuba_platform | 6.2.0 ≤ v < 7.2.23 | 7.2.23 |
| haulmont cuba_rest_api | 7.1.1 ≤ v < 7.2.7 | 7.2.7 |
| haulmont jpa_web_api | 1.0.0 ≤ v < 1.1.1 | 1.1.1 |
| io.jmix.rest:jmix-restMaven | 1.0.0 ≤ v < 1.6.2, 2.0.0 ≤ v < 2.4.0 | 1.6.2, 2.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.