GHSA-mf9q-87xx-jgvv

Liferay Portal allows unrestricted upload of file in the style books component

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-43766

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.liferay:com.liferay.style.book.web	< 2.0.117	2.0.117

Details

As written in the advisory (Markdown source, shown as plain text).

The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows the upload of unrestricted files in the style books component that are processed within the environment enabling arbitrary code execution by attackers.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-43766 advisory
https://github.com/liferay/liferay-portal/commit/d4a5b8fc9f88468168603ff8a1f9b81fa5b7c43e web
https://github.com/liferay/liferay-portal package
https://liferay.atlassian.net/browse/LPE-18145 web
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43766 web