GitHub Advisoryadvisory · Maven

GHSA-p73j-gpcq-49h8 Liferay Portal path traversal vulnerability with the downloading and installation of Xuggler

HIGH Published 2025-06-16 Modified 2025-06-16 Official page ↗
Aliases
CVE-2025-3594
Ecosystem
Maven
Packages
com.liferay:com.liferay.server.admin.web
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-22
Reviewed
2025-06-16

Affected packages

• Maven com.liferay:com.liferay.server.admin.web: >= 5.0.0, < 5.0.24 → fixed in 5.0.24 • Maven com.liferay:com.liferay.server.admin.web: >= 4.0.0, < 4.0.48 → fixed in 4.0.48 • Maven com.liferay:com.liferay.server.admin.web: >= 3.0.0, < 3.0.67 → fixed in 3.0.67 • Maven com.liferay:com.liferay.server.admin.web: >= 2.0.0, < 2.0.66 → fixed in 2.0.66 • Maven com.liferay:com.liferay.server.admin.web: < 1.0.93 → fixed in 1.0.93

Description

Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 34, and older unsupported versions allows remote attackers to (1) add files to arbitrary locations on the server and (2) download and execute arbitrary files from the download server via the `_com_liferay_server_admin_web_portlet_ServerAdminPortlet_jarName` parameter.

Related

Alias · CVE (1)

  • CVE-2025-3594 Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References