Path Traversal and Denial-of-Service Vulnerability in Liferay Portal

CVE-2025-43813

What is CVE-2025-43813?

A flaw in the ComboServlet of Liferay Portal creates a path traversal vulnerability allowing remote attackers to obtain access to arbitrary CSS and JS files. This can lead to multiple loading instances of these files via a crafted URL query string. Affected versions include Liferay Portal 7.4.0 through 7.4.3.107 and various unsupported releases, as well as multiple versions of Liferay DXP, making it crucial for users to apply necessary patches to prevent potential exploits.

References