PT-2025-40037 · Maven · Com.Liferay.Portal:Com.Liferay.Portal.Impl+1

Published 2025-09-30 · Updated 2025-09-30

OSV

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to access arbitrary CSS and JSS files and load the files multiple times via the query string in a URL.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

GHSA-2HM7-R8F3-423H

Affected Products

Com.Liferay.Portal:Com.Liferay.Portal.Impl

Com.Liferay.Portal:Release.Portal.Bom

References · 8

• https://osv.dev/vulnerability/GHSA-2hm7-r8f3-423h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43813 · Security Note
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/9159075ede8a1656bf67a893a486c93a9e9fe70a · Note
• https://github.com/liferay/liferay-portal/commit/9be57d358ae0f6181a138ce08f52b80e4b14778a · Note
• https://github.com/liferay/liferay-portal/commit/7acad68976e831a0f3b855752ad7874e03be1d43 · Note
• https://liferay.atlassian.net/browse/LPE-17865 · Note
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43813 · Note