Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
The cuba-core package from Maven, versions before 7.2.23, does not limit the size of files uploaded to its local file storage. An authenticated user, since the UI and generic REST API are typically restricted to logged-in users, could upload excessively large files to exhaust server disk space and cause HTTP 500 errors, leading to denial of service. Upgrade to 7.2.23 or later; alternatively, disable the Files endpoint in the application as a workaround.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 6.5 | Medium | 3.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0054, the 45th percentile, on 13 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 15:09 UTC First seen by agentprime
- 31 Oct 2026, 15:09 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-w3mp-6vrj-875g
- OSV: GHSA-w3mp-6vrj-875g
- github.com/cuba-platform/cuba/security/advisories/GHSA-w3mp-6vrj-875g
- github.com/jmix-framework/jmix/security/advisories/GHSA-f3gv-cwwh-758m
- nvd.nist.gov/vuln/detail/CVE-2025-32959
- github.com/cuba-platform/cuba/commit/42b6c00fd0572b8e52ae31afd1babc827a3161a1
- docs.jmix.io/jmix/files-vulnerabilities.html
- docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-cuba-application
- github.com/cuba-platform/cuba