CVE-2025-32960

The CUBA REST API add-on performs operations on data and entities. Prior to version 7.2.7, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. This issue has been patched in version 7.2.7. A workaround is provided on the Jmix documentation website.

• CWE-79

• https://docs.jmix.io/jmix/files-vulnerabilities.html
• https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-cuba-application
• https://github.com/cuba-platform/restapi/commit/b3d599f6657d7e212fdb134a61ab5e0888669eb1
• https://github.com/cuba-platform/restapi/security/advisories/GHSA-88h5-34xw-2q56
• https://github.com/jmix-framework/jmix/security/advisories/GHSA-x27v-f838-jh93

Published

Apr 22, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-32955Harden-Runner is a CI/CD security agent that works like an E…6
• CVE-2025-32956ManageWiki is a MediaWiki extension allowing users to manage…8
• CVE-2025-32957baserCMS is a website development framework. Prior to versio…7.2
• CVE-2025-32958Adept is a language for general purpose programming. Prior t…9.8
• CVE-2025-32959CUBA Platform is a high level framework for enterprise appli…6.5
• CVE-2025-3296A vulnerability, which was classified as critical, has been …6.3
• CVE-2025-32961The Cuba JPA web API enables loading and saving any entities…6.4
• CVE-2025-32962Flask-AppBuilder is an application development framework bui…6.1
• CVE-2025-32963MinIO Operator STS is a native IAM Authentication for Kubern…6.9
• CVE-2025-32964ManageWiki is a MediaWiki extension allowing users to manage…4.6
• CVE-2025-32965xrpl.js is a JavaScript/TypeScript API for interacting with …9.3
• CVE-2025-32966DataEase is an open-source BI tool alternative to Tableau. P…9.8