CVE-2025-3594

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.0.0 through 7.4.3.4 Liferay DXP versions 7.4 GA, 7.3 GA through update 34

Description A path traversal vulnerability exists with the downloading and installation of Xuggler, allowing remote attackers to add files to arbitrary locations on the server and download and execute arbitrary files from the download server via the com liferay server admin web portlet ServerAdminPortlet jarName parameter. This issue enables remote attackers to execute files on the server.

Recommendations For Liferay Portal versions 7.0.0 through 7.4.3.4, update to a newer version to mitigate the risk. For Liferay DXP versions 7.4 GA, 7.3 GA through update 34, update to a newer version to mitigate the risk. As a temporary workaround, consider restricting access to the com liferay server admin web portlet ServerAdminPortlet jarName parameter until a patch is available.