XSS in Cuba-Platform Jpawebapi
CVE-2025-32961
The Cuba JPA web API enables loading and saving any entities defined in the application data model by sending simple HTTP requests. Prior to version 1.1.1, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. This issue has been patched in version 1.1.1. A workaround is provided on the Jmix documentation website.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.003 (22.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N.
Affected products
- Cuba-platform Jpawebapi — versions < 1.1.1
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-32961?
- CVE-2025-32961 is a medium-severity vulnerability in Cuba-Platform Jpawebapi, classified under Cross-site Scripting. CVSS score: 6.4/10. Published 2025-04-22.
- How severe is CVE-2025-32961?
- Medium severity. CVSS v3 base score is 6.4 out of 10.