PT-2025-34506 · Liferay · Liferay Portal+1
Published
2025-08-23
·
Updated
2025-08-23
·
CVE-2025-43766
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Liferay Portal versions 7.3.3.131 and earlier, 7.4.0 through 7.4 GA update 92
Liferay DXP versions 2024.Q1.1 through 2024.Q1.12
Liferay DXP versions 2024.Q2.0 through 2024.Q2.13
Liferay DXP versions 2024.Q3.1 through 2024.Q3.13
Liferay DXP version 2024.Q4.0
Description:
The style books component allows the upload of unrestricted files, which are then processed within the environment. This enables attackers to execute arbitrary code.
Recommendations:
Liferay Portal versions prior to 7.3.3.131 should be updated.
Liferay Portal versions 7.4.0 through 7.4 GA update 92 should be updated.
Liferay DXP versions 2024.Q1.1 through 2024.Q1.12 should be updated.
Liferay DXP versions 2024.Q2.0 through 2024.Q2.13 should be updated.
Liferay DXP versions 2024.Q3.1 through 2024.Q3.13 should be updated.
Liferay DXP version 2024.Q4.0 should be updated.
Fix
RCE
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Liferay Dxp
Liferay Portal