{"action":"Upgrade com.haulmont.addon.jpawebapi:jpawebapi-jpawebapi to 1.1.1 or later.","affected":[{"fixed":"1.1.1","introduced":"0"}],"component":"com.haulmont.addon.jpawebapi:jpawebapi-jpawebapi","cve_ids":["CVE-2025-32961"],"ecosystem":"Maven","epss":0.00325,"exploited":false,"fixed_versions":["1.1.1"],"ghsa_id":"GHSA-hg25-w3vg-7279","id":"tcs_01M5N90J2SD6G1EM6G1KAS2JTB","modified_at":"2025-04-23T15:21:43Z","published_at":"2025-04-22T17:00:27Z","references":["https://osv.dev/vulnerability/GHSA-hg25-w3vg-7279","https://github.com/cuba-platform/jpawebapi/security/advisories/GHSA-hg25-w3vg-7279","https://github.com/jmix-framework/jmix/security/advisories/GHSA-x27v-f838-jh93","https://nvd.nist.gov/vuln/detail/CVE-2025-32961","https://github.com/cuba-platform/jpawebapi/commit/78b837d7e2b12d0df69cef1bc6042ebf3bdaf22c","https://docs.jmix.io/jmix/files-vulnerabilities.html","https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-cuba-application","https://github.com/cuba-platform/jpawebapi"],"severity":{"label":"medium","score":6.4},"sources":[{"source":"osv","source_id":"GHSA-hg25-w3vg-7279","url":"https://osv.dev/vulnerability/GHSA-hg25-w3vg-7279"}],"summary":"XSS in the /download Endpoint of the JPA Web API"}