https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 23:11:51 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-233138 EUVD-2026-233138 https://cve.radiocsirt.org/vuln/euvd-2026-233138 https://cve.radiocsirt.org/vuln/fkie_cve-2025-32960 <p>The CUBA REST API add-on performs operations on data and entities. Prior to version 7.2.7, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. This issue has been patched in version 7.2.7. A workaround is provided on the Jmix documentation website.</p> <p>The CUBA REST API add-on performs operations on data and entities. Prior to version 7.2.7, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. This issue has been patched in version 7.2.7. A workaround is provided on the Jmix documentation website.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-32960 https://cve.radiocsirt.org/vuln/ghsa-88h5-34xw-2q56 <p><strong>Affected:</strong> Maven: com.haulmont.addon.restapi:restapi-rest-api</p> <p>### Impact</p> <p>The input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand.</p> <p>The severity of the vulnerability is mitigated by the fact that the application UI and the generic REST API are typically accessible only to authenticated users.</p> <p>### Patches</p> <p>The problem has been fixed in CUBA REST API add-on 7.2.7.</p> <p>### Workarounds</p> <p>A workaround for those who are unable to upgrade: [Disable Files Endpoint in CUBA Application](https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-cuba-application).</p> <p>### References</p> <p>[Files Functionality Vulnerabilities :: Jmix Documentation](https://docs.jmix.io/jmix/files-vulnerabilities.html)</p> <p>Similar vulnerability in Jmix: [XSS in the /files Endpoint of the Generic REST API · Advisory · jmix-framework/jmix](https://github.com/jmix-framework/jmix/security/advisories/GHSA-x27v-f838-jh93)</p> <p><strong>Affected:</strong> Maven: com.haulmont.addon.restapi:restapi-rest-api</p> <p>### Impact</p> <p>The input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand.</p> <p>The severity of the vulnerability is mitigated by the fact that the application UI and the generic REST API are typically accessible only to authenticated users.</p> <p>### Patches</p> <p>The problem has been fixed in CUBA REST API add-on 7.2.7.</p> <p>### Workarounds</p> <p>A workaround for those who are unable to upgrade: [Disable Files Endpoint in CUBA Application](https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-cuba-application).</p> <p>### References</p> <p>[Files Functionality Vulnerabilities :: Jmix Documentation](https://docs.jmix.io/jmix/files-vulnerabilities.html)</p> <p>Similar vulnerability in Jmix: [XSS in the /files Endpoint of the Generic REST API · Advisory · jmix-framework/jmix](https://github.com/jmix-framework/jmix/security/advisories/GHSA-x27v-f838-jh93)</p> https://cve.radiocsirt.org/vuln/ghsa-88h5-34xw-2q56