Jmix Framework
Approved changes feed: RSS · Atom
cpe:2.3:a:haulmont:jmix_framework:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Haulmont (f81b5bcd-7a87-5312-8d4c-1f9b4fd80eef) |
|---|---|
| Product | Jmix Framework (c08f8a3d-c91f-5cbd-8de2-02904067278f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/jmix-framework/jmix |
purl2cpe | 2026-06-01 10:11:05.527519 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-32952 |
vulnerable | 2026-06-08 07:19:01.229052 |
io.jmix.localfs:jmix-localfs affected by DoS in the Local File Storage
MEDIUM (6.5)
Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the local file storage implementation does not restrict the size of uploaded files. An attacker could exploit this by uploading excessively large files, potentially causing the server to run out of space and return HTTP 500 error, resulting in a denial of service. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website.
Published: 2025-04-22T17:32:11.966Z
Updated: 2025-05-27T17:00:25.356Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-32951 |
vulnerable | 2026-06-08 07:19:01.227625 |
io.jmix.rest:jmix-rest allows XSS in the /files Endpoint of the Generic REST API
MEDIUM (6.4)
Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website.
Published: 2025-04-22T17:32:23.401Z
Updated: 2025-05-27T17:18:23.124Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-32950 |
vulnerable | 2026-06-08 07:19:01.225303 |
io.jmix.localfs:jmix-localfs has a Path Traversal in Local File Storage
MEDIUM (6.5)
Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, attackers could manipulate the FileRef parameter to access files on the system where the Jmix application is deployed, provided the application server has the necessary permissions. This can be accomplished either by modifying the FileRef directly in the database or by supplying a harmful value in the fileRef parameter of the `/files` endpoint of the generic REST API. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website.
Published: 2025-04-22T17:14:43.211Z
Updated: 2025-05-27T17:07:11.796Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.