CVE-2025-32961 CUBA JPA Web API Vulnerable to Cross-Site Scripting (XSS) in the /download Endpoint
Attackers can execute malicious JavaScript in browsers via the /download endpoint if a malicious file is uploaded, affecting CUBA JPA Web API users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-32961?
CVE-2025-32961 is a medium-severity cross-site scripting vulnerability in cuba-platform jpawebapi, published on 22 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Cuba JPA web API enables loading and saving any entities defined in the application data model by sending simple HTTP requests. Prior to version 1.1.1, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. This issue has been patched in version 1.1.1. A workaround is provided on the Jmix documentation website.
Weakness: CWE-79
Which versions are affected by CVE-2025-32961?
2 open source packages ship an affected version, including com.haulmont.addon.jpawebapi:jpawebapi-jpawebapi.
| Package | Affected | Fixed in |
|---|---|---|
com.haulmont.addon.jpawebapi:jpawebapi-jpawebapi Maven | All versions | 1.1.1 |
com.haulmont.addon.jpawebapi:jpawebapi-jpawebapi Maven | All versions | 1.1.1 |
How do I fix CVE-2025-32961?
Upgrade com.haulmont.addon.jpawebapi:jpawebapi-jpawebapi to 1.1.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-32961 being exploited?
There is no known exploitation of CVE-2025-32961 in the wild and no public exploit code.
Sources
Also known as GHSA-hg25-w3vg-7279.