{"id":"CVE-2025-32960","published":"2025-04-22T17:45:53Z","modified":"2025-04-23T15:59:07Z","title":"CUBA Generic REST API Vulnerable to Cross-Site Scripting (XSS) in the /files Endpoint","vendor":"cuba-platform","product":"restapi","tier":"tail","description":{"text":"The CUBA REST API add-on performs operations on data and entities. Prior to version 7.2.7, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. This issue has been patched in version 7.2.7. A workaround is provided on the Jmix documentation website.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.4,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00325,"percentile":0.25485,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://github.com/cuba-platform/restapi/security/advisories/GHSA-88h5-34xw-2q56","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/jmix-framework/jmix/security/advisories/GHSA-x27v-f838-jh93","tags":["x_refsource_MISC"]},{"url":"https://github.com/cuba-platform/restapi/commit/b3d599f6657d7e212fdb134a61ab5e0888669eb1","tags":["x_refsource_MISC"]},{"url":"https://docs.jmix.io/jmix/files-vulnerabilities.html","tags":["x_refsource_MISC"]},{"url":"https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-cuba-application","tags":["x_refsource_MISC"]}],"priority":{"score":9.6,"factors":[{"name":"EPSS percentile","points":5.1},{"name":"CVSS severity","points":4.48}]},"vendorSlug":"cuba-platform","affectedVersions":[{"vendor":"cuba-platform","product":"restapi","versions":["< 7.2.7"]}],"affected":[{"ecosystem":"Maven","package":"com.haulmont.addon.restapi:restapi-rest-api","vulnerableRanges":["<7.2.7"],"patched":["7.2.7"],"from":["GHSA-88h5-34xw-2q56"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-12221","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-jmix-framework-jmix-cve-2025-32951","parents":[{"from":"CVE-2025-32951","to":"CVE-2025-32960","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-x27v-f838-jh93","via":"related"},{"kind":"osv-related","provenance":"source","id":"GHSA-88h5-34xw-2q56","via":"reference","url":"https://github.com/jmix-framework/jmix/security/advisories/GHSA-x27v-f838-jh93"}]}]}}