CVE-2025-32951: io.jmix.rest:jmix-rest allows XSS in the /files Endpoint of the Generic REST API
First published: Tue Apr 22 2025(Updated: )
### Impact The input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. The severity of the vulnerability is mitigated by the fact that the application UI and the generic REST API are typically accessible only to authenticated users. Additionally, the /files endpoint in Jmix requires specific permissions and is disabled by default. ### Patches The problem has been fixed in Jmix 1.6.2+ and 2.4.0+. ### Workarounds A workaround for those who are unable to upgrade: [Disable Files Endpoint in Jmix Application](https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-jmix-application).
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/io.jmix.rest:jmix-rest | >=2.0.0<2.4.0 | 2.4.0 |
| maven/io.jmix.rest:jmix-rest | >=1.0.0<1.6.2 | 1.6.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/jmix-framework/jmix/security/advisories/GHSA-x27v-f838-jh93
- https://docs.jmix.io/jmix/files-vulnerabilities.html
- https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-jmix-application
- https://nvd.nist.gov/vuln/detail/CVE-2025-32951
- https://github.com/advisories/GHSA-x27v-f838-jh93 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2025-32951?
CVE-2025-32951 is considered a high severity vulnerability due to the potential for executing malicious JavaScript code in the browser.
How do I fix CVE-2025-32951?
To fix CVE-2025-32951, upgrade to version 2.4.0 or later for the jmix-rest package.
Which versions of jmix-rest are affected by CVE-2025-32951?
CVE-2025-32951 affects jmix-rest versions from 1.0.0 to 1.6.2 and from 2.0.0 to 2.4.0.
What type of attack is possible with CVE-2025-32951?
CVE-2025-32951 allows for cross-site scripting (XSS) attacks through the manipulation of the Content-Type header.
What input is vulnerable in CVE-2025-32951?
CVE-2025-32951 is vulnerable to attacks via the input parameter consisting of file paths ending with .html.
- agent/weakness
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/description
- agent/type
- agent/author
- agent/severity
- collector/nvd-api
- source/NVD
- collector/epss-latest
- source/FIRST
- agent/source
- agent/epss
- collector/nvd-cve
- agent/last-modified-date
- agent/references
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-x27v-f838-jh93
- alias/CVE-2025-32951
- agent/software-canonical-lookup
- agent/tags
- agent/event
- package-manager/maven