What is GHSA-mf9q-87xx-jgvv?

GHSA-mf9q-87xx-jgvv is a security advisory published by GitHub Security Advisories with Medium severity. Liferay Portal allows unrestricted upload of file in the style books component

Which CVE IDs does GHSA-mf9q-87xx-jgvv cover?

GHSA-mf9q-87xx-jgvv covers the following CVE IDs: CVE-2025-43766. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-mf9q-87xx-jgvv?

GHSA-mf9q-87xx-jgvv affects 1 product, including: maven/com.liferay:com.liferay.style.book.web:\u003c 2.0.117.

GHSA-mf9q-87xx-jgvvMedium

Liferay Portal allows unrestricted upload of file in the style books component

Vendor

GitHub Security Advisories

Published

August 23, 2025

Last Modified

August 25, 2025

🔗 CVE IDs covered (1)

CVE-2025-43766 →

📋 Description

The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows the upload of unrestricted files in the style books component that are processed within the environment enabling arbitrary code execution by attackers.

🎯 Affected products1

maven/com.liferay:com.liferay.style.book.web:< 2.0.117

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-43766
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43766
https://github.com/liferay/liferay-portal/commit/d4a5b8fc9f88468168603ff8a1f9b81fa5b7c43e
https://liferay.atlassian.net/browse/LPE-18145
https://github.com/advisories/GHSA-mf9q-87xx-jgvv