CVE-2025-32961: Cuba JPA Web API XSS Vulnerability

CVE-2025-32961 Overview

CVE-2025-32961 is a reflected cross-site scripting (XSS) vulnerability in the Cuba JPA web API, a component used to load and save entities in Cuba/Jmix applications through HTTP requests. Versions prior to 1.1.1 accept a file path parameter that influences the Content-Type header returned by the file download endpoint. When the supplied name ends with .html, the server responds with text/html, causing browsers to render any attacker-controlled content stored in the file. Successful exploitation requires an attacker to first upload a malicious file to the application. The issue is tracked under [CWE-79] and fixed in version 1.1.1.

Critical Impact
An authenticated attacker who can upload a file to the Cuba JPA web API can trigger execution of arbitrary JavaScript in the context of victim browsers, enabling session theft or actions on behalf of the user.

Affected Products

Cuba Platform jpawebapi versions prior to 1.1.1
Cuba applications exposing the files endpoint of the JPA web API
Jmix deployments using the affected Cuba compatibility layer

Discovery Timeline

2025-04-22 - CVE-2025-32961 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32961

Vulnerability Analysis

The Cuba JPA web API exposes a REST file download controller (RestFileDownloadController) that returns files stored on the server. The controller derives the response Content-Type header from the supplied file name. When the name ends with .html, the endpoint responds with Content-Type: text/html, letting the browser interpret the file body as HTML and execute embedded scripts.

Because the response is rendered in the origin of the Cuba application, injected JavaScript runs with access to application cookies, tokens, and DOM. This enables session hijacking, privileged API calls, and phishing overlays.

Exploitation requires prior upload of a malicious file. In deployments where authenticated low-privilege users can upload files, an attacker can chain the upload with a crafted download URL to attack higher-privileged users. The vulnerability is classified as [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Root Cause

The file download endpoint honored a client-controlled extension when setting the response Content-Type and did not restrict which MIME types the endpoint could serve. Combined with the lack of a Content-Disposition: attachment policy and no allow-list of downloadable file types, this allowed HTML content to be rendered inline in the user's browser.

Attack Vector

Exploitation proceeds over the network against an authenticated Cuba JPA web API session. The attacker first uploads a file containing HTML and JavaScript payloads through the files endpoint. The attacker then delivers a link to the download endpoint that references the uploaded file with an .html name. When the victim opens the link while authenticated, the browser renders the file as HTML and executes the embedded script within the application's origin.

java

// Security patch: modules/jpawebapi/src/com/haulmont/addon/jpawebapi/api/config/JpaWebApiConfig.java
 import com.haulmont.cuba.core.config.Property;
 import com.haulmont.cuba.core.config.Source;
 import com.haulmont.cuba.core.config.SourceType;
+import com.haulmont.cuba.core.config.defaults.Default;
 import com.haulmont.cuba.core.config.defaults.DefaultBoolean;
 import com.haulmont.cuba.core.config.defaults.DefaultInt;
+import com.haulmont.cuba.core.config.type.CommaSeparatedStringListTypeFactory;
+import com.haulmont.cuba.core.config.type.Factory;
+
+import java.util.List;
 
 /**
  * JPA WEB API config.

// Source: https://github.com/cuba-platform/jpawebapi/commit/78b837d7e2b12d0df69cef1bc6042ebf3bdaf22c
// The patch introduces a configurable allow-list of permitted file extensions, enforced by RestFileDownloadController.

Detection Methods for CVE-2025-32961

Indicators of Compromise

Requests to the JPA web API files endpoint where the path or name parameter ends with .html, .htm, .svg, or .xhtml.
File uploads via the JPA web API that contain <script>, onerror=, or other HTML event handlers in their content.
Anomalous download responses from the Cuba application returning Content-Type: text/html for user-uploaded files.

Detection Strategies

Inspect web server and reverse proxy logs for downloads served with Content-Type: text/html from the files endpoint of jpawebapi.
Correlate file upload events with subsequent download requests by different users to identify chained exploitation attempts.
Deploy a web application firewall (WAF) rule that flags HTML or SVG content stored through the JPA web API upload path.

Monitoring Recommendations

Monitor authentication and session activity in windows following unusual text/html responses from the JPA web API.
Alert on privileged account browsers loading files-endpoint URLs referencing user-uploaded content.
Track version telemetry for jpawebapi to confirm affected hosts have been upgraded to 1.1.1 or later.

How to Mitigate CVE-2025-32961

Immediate Actions Required

Upgrade the Cuba jpawebapi add-on to version 1.1.1 or later across all environments.
Restrict who can upload files to the JPA web API by tightening role permissions on the files endpoint.
Review existing file storage for HTML, SVG, or script-bearing content uploaded by non-administrative users.

Patch Information

The fix is delivered in jpawebapi version 1.1.1 via commit 78b837d. It adds a configurable list of allowed file extensions enforced by RestFileDownloadController, preventing arbitrary Content-Type responses. See the GitHub Security Advisory GHSA-hg25-w3vg-7279 for the full advisory.

Workarounds

Disable the files endpoint in the Cuba application as described in the Jmix Files Vulnerabilities Documentation.
Configure a reverse proxy to force Content-Disposition: attachment and override the Content-Type header for responses from the JPA web API files endpoint.
Restrict upload permissions on the JPA web API to trusted service accounts only until upgrading is possible.

bash

# Example nginx override to force safe download behavior for the JPA web API files endpoint
location /jpa-web-api/api/files/ {
    proxy_pass http://cuba-backend;
    proxy_hide_header Content-Type;
    add_header Content-Type "application/octet-stream" always;
    add_header Content-Disposition "attachment" always;
    add_header X-Content-Type-Options "nosniff" always;
}