GHSA-x27v-f838-jh93: XSS
First published: Tue Apr 22 2025(Updated: )
### Impact The input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. The severity of the vulnerability is mitigated by the fact that the application UI and the generic REST API are typically accessible only to authenticated users. Additionally, the /files endpoint in Jmix requires specific permissions and is disabled by default. ### Patches The problem has been fixed in Jmix 1.6.2+ and 2.4.0+. ### Workarounds A workaround for those who are unable to upgrade: [Disable Files Endpoint in Jmix Application](https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-jmix-application).
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/io.jmix.rest:jmix-rest | >=2.0.0<2.4.0 | 2.4.0 |
| maven/io.jmix.rest:jmix-rest | >=1.0.0<1.6.2 | 1.6.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/jmix-framework/jmix/security/advisories/GHSA-x27v-f838-jh93
- https://docs.jmix.io/jmix/files-vulnerabilities.html
- https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-jmix-application
- https://nvd.nist.gov/vuln/detail/CVE-2025-32951
- https://github.com/advisories/GHSA-x27v-f838-jh93 (Advisory)
Frequently Asked Questions
What is the severity of GHSA-x27v-f838-jh93?
The severity of GHSA-x27v-f838-jh93 is considered high due to the potential for remote code execution via injected JavaScript.
How do I fix GHSA-x27v-f838-jh93?
To fix GHSA-x27v-f838-jh93, upgrade to version 2.4.0 or later of io.jmix.rest:jmix-rest, or to version 1.6.2 or later.
What versions of io.jmix.rest:jmix-rest are affected by GHSA-x27v-f838-jh93?
Versions from 1.0.0 to 1.6.1 and from 2.0.0 to 2.4.0 of io.jmix.rest:jmix-rest are affected by GHSA-x27v-f838-jh93.
Can GHSA-x27v-f838-jh93 allow for data theft?
Yes, GHSA-x27v-f838-jh93 can potentially lead to data theft if malicious scripts are executed in a user's browser.
What security measures should I take concerning GHSA-x27v-f838-jh93?
Implement strict input validation and upgrade to the recommended versions of the affected software to mitigate the risks associated with GHSA-x27v-f838-jh93.
- agent/source
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/type
- agent/softwarecombine
- agent/severity
- agent/event
- agent/last-modified-date
- agent/references
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-x27v-f838-jh93
- alias/CVE-2025-32951
- agent/software-canonical-lookup
- agent/tags
- package-manager/maven