Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-32959

CUBA Platform is a high level framework for enterprise applications development. Prior to version 7.2.23, the local file storage implementation does not restrict the size of uploaded files. An attacker could exploit this by uploading excessively large files, potentially causing the server to run out of space and return HTTP 500 error, resulting in a denial of service. This issue has been patched in version 7.2.23. A workaround is provided on the Jmix documentation website.

Published

2025-04-22T18:16:00.233

Last Modified

2025-04-23T14:08:13.383

Status

Awaiting Analysis

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

Weaknesses

Type: Secondary
CWE-770

Affected Vendors & Products

References

https://docs.jmix.io/jmix/files-vulnerabilities.html ([email protected])
https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-cuba-application ([email protected])
https://github.com/cuba-platform/cuba/commit/42b6c00fd0572b8e52ae31afd1babc827a3161a1 ([email protected])
https://github.com/cuba-platform/cuba/security/advisories/GHSA-w3mp-6vrj-875g ([email protected])
https://github.com/jmix-framework/jmix/security/advisories/GHSA-f3gv-cwwh-758m ([email protected])