CVE-2025-32950 io.jmix.localfs:jmix-localfs has a Path Traversal in Local File Storage

🗓️ 22 Apr 2025 17:14:43Reported by GitHub_MType

CVE-2025-32950 allows file access via Path Traversal in Jmix versions before 1.6.2 and 2.4.0.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2025-32950	25 Apr 202516:07	–	circl
CNNVD	Jmix 安全漏洞	22 Apr 202500:00	–	cnnvd
CVE	CVE-2025-32950	22 Apr 202517:14	–	cve
EUVD	EUVD-2025-12226	3 Oct 202520:07	–	euvd
Github Security Blog	io.jmix.localfs:jmix-localfs has a Path Traversal in Local File Storage	22 Apr 202516:50	–	github
NVD	CVE-2025-32950	22 Apr 202518:15	–	nvd
OSV	CVE-2025-32950 io.jmix.localfs:jmix-localfs has a Path Traversal in Local File Storage	22 Apr 202517:14	–	osv
OSV	GHSA-JX4G-3XQM-62VH io.jmix.localfs:jmix-localfs has a Path Traversal in Local File Storage	22 Apr 202516:50	–	osv
Positive Technologies	PT-2025-17559	22 Apr 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-32950	26 Apr 202500:03	–	redhatcve

[
  {
    "vendor": "jmix-framework",
    "product": "jmix",
    "versions": [
      {
        "version": ">= 1.0.0, < 1.6.2",
        "status": "affected"
      },
      {
        "version": ">= 2.0.0, < 2.4.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/jmix-framework/jmix/issues/3804
docs	www.docs.jmix.io/jmix/files-vulnerabilities.html
github	www.github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa
github	www.github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2
github	www.github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a
github	www.github.com/jmix-framework/jmix/issues/3836
github	www.github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37
github	www.github.com/jmix-framework/jmix/security/advisories/GHSA-jx4g-3xqm-62vh
docs	www.docs.jmix.io/jmix/files-vulnerabilities.html

27 May 2025 17:07Current

CVSS 3.16.5

EPSS0.00569