CVE-2025-32960: CUBA REST API Add-on XSS Vulnerability

CVE-2025-32960 Overview

CVE-2025-32960 is a reflected cross-site scripting (XSS) vulnerability in the CUBA Platform REST API add-on [CWE-79]. The flaw resides in the file download endpoint, which derives its Content-Type response header from the requested file name. An authenticated attacker who first uploads a file with a .html extension can trigger the server to return text/html, causing embedded JavaScript to execute in the victim's browser. The vulnerability affects versions of the add-on prior to 7.2.7 and has been patched in that release. Exploitation requires low privileges and no user interaction beyond visiting the crafted link.

Critical Impact
An authenticated attacker can execute arbitrary JavaScript in a victim's browser session by uploading an HTML file and tricking users into accessing it through the REST API download endpoint.

Affected Products

CUBA Platform REST API add-on versions prior to 7.2.7
Jmix Framework applications relying on the CUBA REST API compatibility layer
Applications built on the Haulmont CUBA platform exposing the files endpoint

Discovery Timeline

2025-04-22 - CVE-2025-32960 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32960

Vulnerability Analysis

The CUBA REST API add-on exposes a file download controller that resolves the Content-Type header based on the file name supplied in the request. When the name parameter ends with .html, the server returns the file contents with Content-Type: text/html, causing the browser to render and execute any embedded script. This behavior creates a reflected XSS primitive against authenticated users of the application.

Successful exploitation requires an attacker to first upload a malicious HTML file through the add-on's file upload functionality. The attacker then distributes a link to the download endpoint that references the uploaded file. When a victim with an active session visits the link, the browser executes attacker-controlled JavaScript in the application's origin.

The issue is tracked under advisories GHSA-88h5-34xw-2q56 for the CUBA platform and GHSA-x27v-f838-jh93 for Jmix. See the GitHub Advisory GHSA-88h5-34xw-2q56 for the full disclosure.

Root Cause

The root cause is improper neutralization of input used in a web page [CWE-79]. The FileDownloadController class in modules/rest-api/src/com/haulmont/addon/restapi/api/controllers/FileDownloadController.java trusts the file extension embedded in the name parameter when selecting the response content type. No allowlist of safe MIME types or Content-Disposition: attachment enforcement prevents inline rendering of HTML content from user-uploaded files.

Attack Vector

The attack is network-based and requires low privileges, specifically a valid account with permission to upload files and a valid session for the victim. No local access or elevated permissions are needed. The scope changes because scripts execute in the context of the vulnerable web application, impacting the confidentiality and integrity of the victim's session.

java

// Security patch adding configuration import to RestApiConfig.java
 import com.haulmont.cuba.core.config.Property;
 import com.haulmont.cuba.core.config.Source;
 import com.haulmont.cuba.core.config.SourceType;
+import com.haulmont.cuba.core.config.defaults.Default;
 import com.haulmont.cuba.core.config.defaults.DefaultBoolean;
 import com.haulmont.cuba.core.config.defaults.DefaultString;
 import com.haulmont.cuba.core.config.type.CommaSeparatedStringListTypeFactory;

// Security patch in FileDownloadController.java introducing FilenameUtils and config checks
 package com.haulmont.addon.restapi.api.controllers;

+import com.haulmont.addon.restapi.api.config.RestApiConfig;
 import com.haulmont.addon.restapi.api.exception.RestAPIException;
 import com.haulmont.bali.util.URLEncodeUtils;
 import com.haulmont.cuba.core.app.DataService;
 import com.haulmont.cuba.core.entity.FileDescriptor;
 import com.haulmont.cuba.core.global.*;
 import com.haulmont.cuba.core.sys.remoting.discovery.ServerSelector;
 import com.haulmont.cuba.security.entity.EntityOp;
+import org.apache.commons.io.FilenameUtils;
 import org.apache.commons.io.IOUtils;
 import org.apache.commons.lang3.BooleanUtils;
 import org.apache.commons.lang3.StringUtils;
// Source: https://github.com/cuba-platform/restapi/commit/b3d599f6657d7e212fdb134a61ab5e0888669eb1

The patch introduces FilenameUtils and a new RestApiConfig reference, enabling the controller to apply filename parsing and a configurable allowlist when determining the response content type.

Detection Methods for CVE-2025-32960

Indicators of Compromise

HTTP GET requests to the CUBA REST API file download endpoint referencing file names ending in .html or .htm
Server responses from the file download controller carrying Content-Type: text/html for user-uploaded assets
File upload requests that store HTML, SVG, or script-bearing content submitted by non-administrative accounts

Detection Strategies

Inspect application and reverse proxy logs for file download URLs that terminate in .html and correlate them with the originating upload request
Monitor web application firewall (WAF) alerts for cross-site scripting signatures triggered on responses from the files endpoint
Audit the CUBA FileDescriptor table for recently uploaded files whose names contain HTML or script extensions

Monitoring Recommendations

Centralize REST API access logs in a SIEM and alert on anomalous download patterns tied to low-privilege accounts
Baseline normal MIME types returned by the files endpoint and alert when text/html is served to end users
Track account activity for upload-then-download sequences that could indicate exploitation attempts

How to Mitigate CVE-2025-32960

Immediate Actions Required

Upgrade the CUBA REST API add-on to version 7.2.7 or later, which contains the official fix
Review existing stored files for HTML, SVG, or JavaScript payloads uploaded by untrusted accounts and remove any suspicious entries
Rotate session tokens and credentials for users who may have interacted with attacker-controlled download links

Patch Information

The vulnerability is resolved in CUBA REST API add-on 7.2.7. The upstream fix is published in the Cuba Platform REST API Commit and documented in the Jmix Framework Advisory GHSA-x27v-f838-jh93. Jmix maintainers also provide operational guidance in the Jmix File Vulnerabilities Documentation.

Workarounds

Disable the CUBA files endpoint if it is not required, following the Disable Files Endpoint Guide
Restrict the file upload endpoint to trusted administrative roles through application access controls
Enforce Content-Disposition: attachment on file download responses at the reverse proxy or WAF layer to prevent inline HTML rendering
Apply a Content Security Policy (CSP) that blocks inline script execution on the application origin

bash

# Example reverse proxy configuration forcing attachment downloads for the files endpoint
location /rest/v2/files {
    proxy_pass http://cuba-backend;
    proxy_hide_header Content-Disposition;
    add_header Content-Disposition "attachment" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Content-Security-Policy "default-src 'none'; script-src 'none'" always;
}