Paper/Archive/CVE-2025-3594

CVE-2025-3594

Liferay Portal — Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.…

EPSS 0.7%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 52.5.525 × 2010.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 34, and older unsupported versions allows remote attackers to (1) add files to arbitrary locations on the server and (2) download and execute arbitrary files from the download server via the `_com_liferay_server_admin_web_portlet_ServerAdminPortlet_jarName` parameter.

Affected

ProductAffectedFixed inSource

Portal7.0.0 – 7.4.3.4–CNA

DXP6.2.0 – portal-173–CNA

DXP7.0.10 – de-102–CNA

DXP7.1.10 – dxp-28–CNA

DXP7.2.10 – dxp-20–CNA

DXP7.3.10 – 7.3.10-u34–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Liferay (CNA)8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refliferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3594