6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-32952

CVE-2025-32952: io.jmix.localfs:jmix-localfs affected by DoS in the Local File Storage

Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the local file storage implementation does not restrict the size of uploaded files. An attacker could exploit this by uploading excessively large files, potentially causing the server to run out of space and return HTTP 500 error, resulting in a denial of service. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-32952

CVE-2025-32952:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.jmix.localfs:jmix-localfs	maven	>= 1.0.0, < 1.6.2	1.6.2
io.jmix.localfs:jmix-localfs	maven	>= 2.0.0, < 2.4.0	2.4.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description states that the local file storage implementation does not restrict the size of uploaded files. I analyzed the provided commits, which are patches for this vulnerability. Both commits 6a66aa3adb967159a30d703e80403406f4c8f7a2 and c589ef4e2b25620770b8036f4ad05f1a6250cb6a modify the LocalFileStorage.java file. The core change is within the saveStream method.

Before the patch, the saveStream method used IOUtils.copyLarge(inputStream, outputStream) without any size restriction. The patch introduces maxAllowedSize = properties.getMaxFileSize().toBytes(); and changes the copy operation to IOUtils.copyLarge(inputStream, outputStream, 0, maxAllowedSize);. It also adds logic to check if size >= maxAllowedSize and if there are still unread bytes, then it deletes the partially uploaded file and throws a FileStorageException.

This clearly indicates that the saveStream function was the point where the unrestricted file upload occurred, making it the vulnerable function. The other modified files (LocalFileStorageProperties.java, RestProperties.java, FileDownloadController.java) are related to configuring the new size limit and handling file downloads, but the vulnerability itself lies in the saveStream method's lack of size enforcement prior to the patch.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.