N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-43766

CVE-2025-43766: Liferay Portal allows unrestricted upload of file in the style books component

The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows the upload of unrestricted files in the style books component that are processed within the environment enabling arbitrary code execution by attackers.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-43766

CVE-2025-43766:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay:com.liferay.style.book.web	maven	< 2.0.117	2.0.117

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2025-43766, allows for unrestricted file uploads in the Liferay Portal's style books component, which can lead to arbitrary code execution. The analysis of the provided patch commit d4a5b8fc9f88468168603ff8a1f9b81fa5b7c43e reveals the exact location of the vulnerability.

The core of the issue lies within the UpdateStyleBookEntryPreviewMVCActionCommand.java file. The doProcessAction method in this class is responsible for handling the file upload for style book previews. The diff shows that prior to the patch, the code did not perform any validation on the uploaded file's extension or MIME type. It would accept any file, which an attacker could exploit by uploading a malicious script (e.g., a JSP file).

The patch rectifies this by introducing two key changes:

Backend Validation: In UpdateStyleBookEntryPreviewMVCActionCommand.doProcessAction, a check is added to validate the file extension against a whitelist of image formats (.bmp, .jpeg, .jpg, .png, .tiff) and to ensure the MIME type starts with image/. If the file is invalid, an error is flagged and the upload is rejected.
Frontend Restriction: In StyleBookEntryActionDropdownItemsProvider.java, the file upload component is now configured to only allow the selection of files with the whitelisted image extensions. This is a client-side mitigation that improves user experience and provides an initial layer of defense.

Based on this evidence, the primary vulnerable function is com.liferay.style.book.web.internal.portlet.action.UpdateStyleBookEntryPreviewMVCActionCommand.doProcessAction, as it contained the flawed logic that permitted the unrestricted file upload on the server side.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.