CVE-2025-3586 json
Liferay Portal and DXP Instance Admin can execute code using Objects Actions and Validations
published 2025-09-01 14 mo ago modified 2026-10-18 21 d ago also GHSA-m5gv-vj3f-6v2p , EUVD-2025-26484
- cvss
- 7.2
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 36%
- public exploits
- 0
- none known
Summary
In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 27 through update 42 (Liferay PaaS, and Liferay Self-Hosted), the Objects module does not restrict the use of Groovy scripts in Object actions for Admin Users. This allows remote authenticated admin users with the Instance Administrator role to execute arbitrary Groovy scripts (i.e., remote code execution) through Object actions.
In contrast, in Liferay DXP (Liferay SaaS), the use of Groovy in Object actions is not allowed due to the high security risks it poses.
Starting from Liferay DXP 2024.Q2 and later, a new feature has been introduced in Instance Settings that allows administrators to configure whether Groovy scripts are allowed in their instances.
Patch / fix
- maven com.liferay:com.liferay.object.service 1.0.96
- liferay liferay_portal 7.4.3.43
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 14 mo ago
Exploit prediction
0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.5 | CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 7.5 | CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.liferay:com.liferay.object.service | <1.0.96 |
1.0.96 |
Affected products
- Liferay Portal
- Liferay DXP
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
github.com
/liferay/liferay-portal/commit/3b9e3bb1462ccd33ede05f73f45b38b8262f018f
web
-
github.com
/liferay/liferay-portal/commit/79ddc243e60864c0c30cfccb1cc46e705e922cb0
web
-
github.com
/liferay/liferay-portal/commit/b2aa19be228fb308ebe8ae1f47d3224e1fd06225
web
-
liferay.dev
/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3586
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-3586
advisory
-
github.com
/liferay/liferay-portal
package
-
liferay.atlassian.net
/browse/LPE-17586
web
Sources
- CVE List CVE-2025-3586
- GitHub Advisory GHSA-m5gv-vj3f-6v2p
- NVD CVE-2025-3586
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.