https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 19:45:01 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-232860 EUVD-2026-232860 https://cve.radiocsirt.org/vuln/euvd-2026-232860 https://cve.radiocsirt.org/vuln/fkie_cve-2025-32959 <p>CUBA Platform is a high level framework for enterprise applications development. Prior to version 7.2.23, the local file storage implementation does not restrict the size of uploaded files. An attacker could exploit this by uploading excessively large files, potentially causing the server to run out of space and return HTTP 500 error, resulting in a denial of service. This issue has been patched in version 7.2.23. A workaround is provided on the Jmix documentation website.</p> <p>CUBA Platform is a high level framework for enterprise applications development. Prior to version 7.2.23, the local file storage implementation does not restrict the size of uploaded files. An attacker could exploit this by uploading excessively large files, potentially causing the server to run out of space and return HTTP 500 error, resulting in a denial of service. This issue has been patched in version 7.2.23. A workaround is provided on the Jmix documentation website.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-32959 https://cve.radiocsirt.org/vuln/ghsa-w3mp-6vrj-875g <p><strong>Affected:</strong> Maven: com.haulmont.cuba:cuba-core</p> <p>### Impact</p> <p>The local file storage implementation does not restrict the size of uploaded files. An attacker could exploit this by uploading excessively large files, potentially causing the server to run out of space and return HTTP 500 error, resulting in a denial of service.</p> <p>The severity of the vulnerability is mitigated by the fact that the application UI and the generic REST API are typically accessible only to authenticated users.</p> <p>### Patches</p> <p>The problem has been fixed in CUBA 7.2.23.</p> <p>### Workarounds</p> <p>A workaround for those who are unable to upgrade: [Disable Files Endpoint in CUBA Application](https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-cuba-application).</p> <p>### References</p> <p>[Files Functionality Vulnerabilities :: Jmix Documentation](https://docs.jmix.io/jmix/files-vulnerabilities.html)</p> <p>Similar vulnerability in Jmix: [DoS in the Local File Storage · Advisory · jmix-framework/jmix](https://github.com/jmix-framework/jmix/security/advisories/GHSA-f3gv-cwwh-758m)</p> <p><strong>Affected:</strong> Maven: com.haulmont.cuba:cuba-core</p> <p>### Impact</p> <p>The local file storage implementation does not restrict the size of uploaded files. An attacker could exploit this by uploading excessively large files, potentially causing the server to run out of space and return HTTP 500 error, resulting in a denial of service.</p> <p>The severity of the vulnerability is mitigated by the fact that the application UI and the generic REST API are typically accessible only to authenticated users.</p> <p>### Patches</p> <p>The problem has been fixed in CUBA 7.2.23.</p> <p>### Workarounds</p> <p>A workaround for those who are unable to upgrade: [Disable Files Endpoint in CUBA Application](https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-cuba-application).</p> <p>### References</p> <p>[Files Functionality Vulnerabilities :: Jmix Documentation](https://docs.jmix.io/jmix/files-vulnerabilities.html)</p> <p>Similar vulnerability in Jmix: [DoS in the Local File Storage · Advisory · jmix-framework/jmix](https://github.com/jmix-framework/jmix/security/advisories/GHSA-f3gv-cwwh-758m)</p> https://cve.radiocsirt.org/vuln/ghsa-w3mp-6vrj-875g