CVSS 4.0
6.8 mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:NCVE-2025-43766
Medium (6.8) in liferay. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in com.liferay:com.liferay.style.book.web 2.0.117.
The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows the upload of unrestricted files in the style books component that are processed within the environment enabling arbitrary code execution by attackers.
Severity
CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
- CWE
- CWE-434
- Published
- Modified
- Record from
- the NVD, synced
Affected
- liferay:digital_experience_platform
- liferay:liferay_portal
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mf9q-87xx-jgvv | Maven | com.liferay:com.liferay.style.book.web | <2.0.117 | 2.0.117 |