Liferay · Liferay Portal · CVE-2025-43813
**Name of the Vulnerable Software and Affected Versions**
Liferay Portal versions 7.3 GA through update 35
Liferay Portal versions 7.4.0 through 7.4.3.107
Liferay DXP versions 2023.Q3.1 through 2023.Q3.8
Liferay DXP versions 2023.Q4.0 through 2023.Q4.4
Liferay Portal 7.4 GA through update 92
**Description**
The ComboServlet component may be susceptible to path traversal and denial-of-service conditions. This allows remote attackers to access arbitrary CSS and JSS files. Attackers can also load these files repeatedly by manipulating the query string within a URL.
**Recommendations**
Update Liferay Portal to a version later than 7.4.3.107.
Update Liferay Portal to a version later than 7.4 update 92.
Update Liferay DXP to a version later than 2023.Q3.8.
Update Liferay DXP to a version later than 2023.Q4.4.
Update Liferay Portal to a version later than 7.3 update 35.