Description

The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows the upload of unrestricted files in the style books component that are processed within the environment enabling arbitrary code execution by attackers.

Remediation

References

CVE-2025-43766

Related Vulnerabilities

Ruby Resource Management Errors Vulnerability (CVE-2008-3656)

WordPress Plugin WP Forum Server Cross-Site Scripting and SQL Injection Vulnerabilities (1.7.3)

WordPress Plugin SAML SP Single Sign On-SSO login Unspecified Vulnerability (4.8.70)

MyBB Exposure of Sensitive Information Through Metadata Vulnerability (CVE-2025-48941)

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-38274)

Severity

Critical

Classification

CVE-2025-43766 CWE-434 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities