CVE-2025-32960 Details

Disable the '/files' REST endpoint: 1. Create a class in the 'web' module of your project (change the package accordingly): BlockingFilter.java package com.company.sample.web; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.web.filter.OncePerRequestFilter; import javax.servlet.FilterChain; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.io.IOException; public class BlockingFilter extends OncePerRequestFilter { private static final Logger log = LoggerFactory.getLogger(BlockingFilter.class); @Override protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws IOException { String requestURI = request.getRequestURI(); log.debug('Block request to ' + requestURI); response.setStatus(HttpServletResponse.SC_FORBIDDEN); response.getWriter().write('This endpoint is disabled.'); } } 2. Add the following filter configuration to the end of the 'WEB-INF/web.xml' file of your 'web' module (use the real package name of the BlockingFilter class): web/WEB-INF/web.xml <filter> <filter-name>cuba_blocking_filter</filter-name> <filter-class>com.company.sample.web.BlockingFilter</filter-class> <async-supported>true</async-supported> </filter> <filter-mapping> <filter-name>cuba_blocking_filter</filter-name> <url-pattern>/rest/v2/files/*</url-pattern> </filter-mapping> 3. If you are using the legacy CUBA REST v1 (which was extracted to JPA Web API add-on since CUBA 7.1), you should disable '/upload' and '/download' endpoints. Add the following filter mappings to the 'web.xml' file in addition to the filter configuration shown above: web/WEB-INF/web.xml <filter-mapping> <filter-name>cuba_blocking_filter</filter-name> <url-pattern>/dispatch/api/upload</url-pattern> </filter-mapping> <filter-mapping> <filter-name>cuba_blocking_filter</filter-name> <url-pattern>/dispatch/api/download</url-pattern> </filter-mapping>