CVE-2025-32950
Jmix is a set of libraries and tools to speed
Publication date: 2025-04-22
Last updated on: 2025-12-31
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Affected Vendors & Products
| Vendor | Product | Version |
|---|---|---|
| haulmont | jmix_framework | From 1.0.0 (inc) to 1.6.2 (exc) |
| haulmont | jmix_framework | From 2.0.0 (inc) to 2.4.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
| CWE-35 | The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-32950 is a path traversal vulnerability in the Jmix Local File Storage component. Attackers can manipulate the FileRef parameter (either directly in the database or via the /files endpoint of the generic REST API) to access arbitrary files on the system where the application is deployed, provided the server’s permissions allow it. The issue has been fixed in versions 1.6.2 and 2.4.0. [1, 3]
How can this vulnerability impact me? :
If you are using affected versions of Jmix (versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4), an attacker could exploit this vulnerability to read arbitrary files on your system, potentially exposing sensitive data. While the risk is somewhat mitigated by authentication and restricted access to the /files endpoint, the vulnerability could still lead to unauthorized file access if proper security measures are not in place. [1, 3]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation steps include upgrading to the patched versions (1.6.2 for the 1.x series or 2.4.0 for the 2.x series) or applying the workaround as described on the Jmix documentation website. [1, 3]