GitHub Advisoryadvisory · Maven

GHSA-mf9q-87xx-jgvv Liferay Portal allows unrestricted upload of file in the style books component

MEDIUM Published 2025-08-23 Modified 2025-08-25 Official page ↗
Aliases
CVE-2025-43766
Ecosystem
Maven
Packages
com.liferay:com.liferay.style.book.web
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-434
Reviewed
2025-08-25

Affected packages

• Maven com.liferay:com.liferay.style.book.web: < 2.0.117 → fixed in 2.0.117

Description

The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows the upload of unrestricted files in the style books component that are processed within the environment enabling arbitrary code execution by attackers.

Related

Alias · CVE (1)

  • CVE-2025-43766 The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,… vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References