CVE-2018-10795

8.8 highEPSS 1.7%

Liferay 6.2.x and before has an FCKeditor configuration that allows an attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment via a browser/liferay/browser.html?Type= or html/js/editor/fckeditor/editor/filemanager/browser/liferay/browser.html URI. NOTE: the vendor disputes this issue because file upload is an expected feature, subject to Role Based Access Control checks where only authenticated users with proper permissions can upload files

Severity

CVSS 3.0

8.8 high

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.7% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2018-05-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

liferay:liferay_portal

References

https://cxsecurity.com/issue/WLB-2018050029
https://cxsecurity.com/issue/WLB-2018050029

Check your stack JSON