CVE-2025-32959

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2025-04-22

Last updated on: 2025-04-23

Assigner: GitHub, Inc.

Description

CUBA Platform is a high level framework for enterprise applications development. Prior to version 7.2.23, the local file storage implementation does not restrict the size of uploaded files. An attacker could exploit this by uploading excessively large files, potentially causing the server to run out of space and return HTTP 500 error, resulting in a denial of service. This issue has been patched in version 7.2.23. A workaround is provided on the Jmix documentation website.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-04-22

Last Modified

2025-04-23

Generated

2026-07-27

AI Q&A

2025-04-23

EPSS Evaluated

2026-07-26

NVD

CVE-2025-32959

EUVD

EUVD-2025-12222

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

The vulnerability is an unrestricted file upload issue in CUBA Platform versions prior to 7.2.23. Because the local file storage implementation does not restrict the size of uploaded files, an attacker can upload excessively large files. This could fill up the server’s disk space, leading to HTTP 500 errors and thus causing a denial of service. The issue has been fixed in version 7.2.23, and a workaround is available by disabling the Files Endpoint. [4]

Impact Analysis

If you are running a vulnerable version of the CUBA Platform, an attacker could exploit this issue to exhaust your server's disk space with large file uploads. This would result in HTTP 500 errors and a denial of service, potentially making your application unavailable to legitimate users. [4]

Mitigation Strategies

To mitigate this vulnerability, you should upgrade to CUBA Platform version 7.2.23 where the issue has been fixed. If upgrading immediately is not feasible, as a workaround, disable the Files Endpoint in your CUBA Application. [2, 4]

Hi! I’m here to help you understand CVE-2025-32959. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70