IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-08-23 05:15

MODIFIED

2025-08-25 20:24

EPSS (Prob. Exploit)

0.44%

Top 61.5%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-04 OSV 🔗 2026-11-08

> DESCRIPTION

The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows the upload of unrestricted files in the style books component that are processed within the environment enabling arbitrary code execution by attackers.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-mf9q-87xx-jgvv MODERATE

Liferay Portal allows unrestricted upload of file in the style books component

AFFECTED PACKAGES:

MAVEN / com.liferay:com.liferay.style.book.web

< 2.0.117

Fixed in: 2.0.117

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:

Unknown / Unknown

9 versions affected

ALIASES:

GHSA-mf9q-87xx-jgvv

> HISTORIQUE DES MODIFICATIONS

Première apparition

23/08/2025 05:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:07

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui