6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-32959

CVE-2025-32959: Cuba has a DoS in the File Storage

Impact

The local file storage implementation does not restrict the size of uploaded files. An attacker could exploit this by uploading excessively large files, potentially causing the server to run out of space and return HTTP 500 error, resulting in a denial of service.

The severity of the vulnerability is mitigated by the fact that the application UI and the generic REST API are typically accessible only to authenticated users.

Patches

The problem has been fixed in CUBA 7.2.23.

Workarounds

A workaround for those who are unable to upgrade: Disable Files Endpoint in CUBA Application.

References

Files Functionality Vulnerabilities :: Jmix Documentation

Similar vulnerability in Jmix: DoS in the Local File Storage · Advisory · jmix-framework/jmix

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-32959

CVE-2025-32959:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.haulmont.cuba:cuba-core	maven	< 7.2.23	7.2.23

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is a Denial of Service caused by unrestricted file upload size in Cuba's File Storage. The provided commit 42b6c00fd0572b8e52ae31afd1babc827a3161a1 addresses this issue.

The file modules/core/src/com/haulmont/cuba/core/app/filestorage/FileStorage.java contains the saveStream method. This method is modified to incorporate a file size check. Previously, it used IOUtils.copyLarge(inputStream, os) without a size limit. The patch changes this to IOUtils.copyLarge(inputStream, os, 0, maxAllowedSize) and adds subsequent checks to ensure the file does not exceed maxAllowedSize. This directly indicates that the saveStream method, in its pre-patch version, was the point where the vulnerability existed, as it processed and saved the input stream without validating its size.
The file modules/core/src/com/haulmont/cuba/core/app/ServerConfig.java was modified to add a new configuration property cuba.fileStorageMaxFileSize and a getter getFileStorageMaxFileSize(). This provides the mechanism for defining the maximum allowed file size, which is then used by FileStorage.saveStream.
The file modules/global/src/com/haulmont/cuba/core/config/type/DataSizeTypeFactory.java was added to parse the string representation of the file size (e.g., "100MB") into a usable DataSize object.

The function com.haulmont.cuba.core.app.filestorage.FileStorage.saveStream is identified as vulnerable because it was the function directly responsible for writing the file stream to disk. Before the patch, it did not enforce any size limits, allowing an attacker to upload arbitrarily large files, thereby consuming all available disk space and causing a denial of service. The patch mitigates this by introducing size checks within this function, using the newly added configuration for the maximum file size.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.