CVE-2025-43813 json
Liferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet
published 2025-09-29 13 mo ago modified 2026-10-18 21 d ago also GHSA-2hm7-r8f3-423h , EUVD-2025-31658
- cvss
- 8.2
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 42%
- public exploits
- 0
- none known
Summary
Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to access arbitrary CSS and JSS files and load the files multiple times via the query string in a URL.
Patch / fix
- maven com.liferay.portal:release.portal.bom 7.4.3.108-ga108
- maven com.liferay.portal:com.liferay.portal.impl 96.0.0
- liferay digital_experience_platform 7.3, 2023.q3.9, 2023.Q4.5
- liferay liferay_portal 7.4.3.108
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 13 mo ago
Exploit prediction
0.50% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.liferay.portal:release.portal.bom | >=7.4.0-ga1, <7.4.3.108-ga108 |
7.4.3.108-ga108 |
| maven | com.liferay.portal:com.liferay.portal.impl | <96.0.0 |
96.0.0 |
Affected products
- Liferay Portal
- Liferay DXP
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/liferay/liferay-portal/commit/7acad68976e831a0f3b855752ad7874e03be1d43
web
-
github.com
/liferay/liferay-portal/commit/9159075ede8a1656bf67a893a486c93a9e9fe70a
web
-
github.com
/liferay/liferay-portal/commit/9be57d358ae0f6181a138ce08f52b80e4b14778a
web
-
liferay.dev
/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43813
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-43813
advisory
-
github.com
/liferay/liferay-portal
package
-
liferay.atlassian.net
/browse/LPE-17865
web
Sources
- CVE List CVE-2025-43813
- GitHub Advisory GHSA-2hm7-r8f3-423h
- NVD CVE-2025-43813
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.