Description

The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows the upload of unrestricted files in the style books component that are processed within the environment enabling arbitrary code execution by attackers.

Remediation

References

CVE-2025-43766

Related Vulnerabilities

WordPress Plugin Gallery Plugin for WordPress-Envira Photo Gallery Cross-Site Scripting (1.7.6)

WordPress Plugin Simple JWT Login-Login and Register to WordPress using JWT Insecure Password Creation (3.2.1)

SharePoint Heap-based Buffer Overflow Vulnerability (CVE-2026-55125)

Apache Tomcat Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2017-12615)

MediaWiki Exposure of Resource to Wrong Sphere Vulnerability (CVE-2021-44854)

Severity

Critical

Classification

CVE-2025-43766 CWE-434 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities