Description

The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows the upload of unrestricted files in the style books component that are processed within the environment enabling arbitrary code execution by attackers.

Remediation

References

CVE-2025-43766

Related Vulnerabilities

WordPress Plugin Category Specific RSS feed Subscription Cross-Site Request Forgery (2.0)

WordPress Plugin wpcu3er 'ajaxReq.php' Arbitrary File Upload (0.55)

WordPress Plugin wpDataTables-WordPress Data Table, Dynamic Tables & Table Charts (Premium) SQL Injection (6.3.1)

WordPress Plugin Custom Contact Forms Multiple Cross-Site Scripting Vulnerabilities (5.0.0.1)

WordPress Plugin St-Daily-Tip Cross-Site Request Forgery (4.7)

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CWE-434 CVE-2025-43766