PT-2025-25557 · Xuggler+1 · Xuggler+2

Published 2025-06-16 · Updated 2025-12-12 · CVE-2025-3594

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.0.0 through 7.4.3.4 Liferay DXP versions 7.4 GA, 7.3 GA through update 34

Description A path traversal vulnerability exists with the downloading and installation of Xuggler, allowing remote attackers to add files to arbitrary locations on the server and download and execute arbitrary files from the download server via the com liferay server admin web portlet ServerAdminPortlet jarName parameter. This issue enables remote attackers to execute files on the server.

Recommendations For Liferay Portal versions 7.0.0 through 7.4.3.4, update to a newer version to mitigate the risk. For Liferay DXP versions 7.4 GA, 7.3 GA through update 34, update to a newer version to mitigate the risk. As a temporary workaround, consider restricting access to the com liferay server admin web portlet ServerAdminPortlet jarName parameter until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-3594

GHSA-P73J-GPCQ-49H8

Affected Products

Liferay Dxp

Liferay Portal

Xuggler

References · 10

• https://osv.dev/vulnerability/GHSA-p73j-gpcq-49h8 · Vendor Advisory
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3594 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-3594 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3594 · Security Note
• https://github.com/liferay/liferay-portal · Note
• https://twitter.com/CVEnew/status/1934623395326431687 · Twitter Post
• https://t.me/cvetracker/26318 · Telegram Post
• https://twitter.com/SecAideInfo/status/1935642701992497444 · Twitter Post
• https://t.me/cveNotify/145657 · Telegram Post
• https://twitter.com/CveFindCom/status/1934622069116813615 · Twitter Post