CVE-2025-32952mediumCWE-770

CVE-2025-32952: fallo de gravedad media en jmix-framework jmix

io.jmix.localfs:jmix-localfs affected by DoS in the Local File Storage

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear jmix+ Monitorear io.jmix.localfs:jmix-localfs

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.5epss 0.7%
Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the local file storage implementation does not restrict the size of uploaded files. An attacker could exploit this by uploading excessively large files, potentially causing the server to run out of space and return HTTP 500 error, resulting in a denial of service. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Productos afectados
jmix-framework · jmix
CVEs relacionadas — jmix-framework jmix

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-32950MEDIUMio.jmix.localfs:jmix-localfs has a Path Traversal in Local File StorageEPSS 0.7%CVE-2025-32951MEDIUMio.jmix.rest:jmix-rest allows XSS in the /files Endpoint of the Generic REST APIEPSS 0.4%