CVE-2025-43766 is a critical (CVSS 9.8) unrestricted file upload flaw in the style books component of Liferay Portal and Liferay DXP. Uploaded files are processed in the environment, which enables arbitrary code execution. Update to a fixed release named in the Liferay security advisory for this CVE.
What's affected
The record lists Liferay Portal 7.4.0 through 7.3.3.131 as written, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, and 7.4 GA through update 92. The Portal range as printed looks inconsistent, with 7.4.0 running up to a 7.3 number, so read the advisory for the intended range.
Liferay's known vulnerabilities page for the CVE carries the fixed versions. The page I fetched did not render the detail fields, so I cannot quote them here. Open the advisory and use the fixed versions it lists for your release line.
The component is style books, the feature used to define the look of sites. Do not assume you are safe because nobody uses style books. The record scopes the flaw by version, so match your version first.
How to check if you're exposed
Find the exact version of each Liferay instance. In the control panel, the about or server information screen shows the Portal or DXP version and update level. Compare it with the ranges above and with the advisory.
For DXP, note the quarterly release and the update number. A line such as 2024.Q2.13 is both a quarter and an update, and the last affected update differs for each quarter.
Check whether the instance is reachable from the internet and who holds permissions to reach the style books feature. Review upload and file storage locations for files that do not belong, such as unexpected script files.
What to do now
- Inventory all Liferay Portal and DXP instances with their versions.
- Read the Liferay advisory for CVE-2025-43766 and note the fixed version for each release line.
- Apply the update or the fix pack in a test environment, then production.
- Until patched, restrict access to the portal administration surfaces by network, and review who can reach the style books feature.
- Scan upload directories and document library storage for unexpected executable content.
- Review web server and application logs around file upload requests for anything unusual.
Why it matters
The class is unrestricted upload of a dangerous file type, CWE-434 (Unrestricted Upload of File with Dangerous Type). The component accepts files and later processes them in the environment, without limits on what kind of file is accepted or what the server does with it. When a file can be treated as code, upload turns into code execution.
The vector lists network access, low complexity, no privileges and no user interaction, which is why the score is 9.8. An internet facing portal is a direct target. Portals also tend to hold identity data, integrations with other systems and credentials in configuration.
The record does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list. Treat patching as urgent anyway, because file upload flaws are simple to find and reliable once found.
Quick check
Do I need an account to be vulnerable?
The vector says no privileges are required, so an unauthenticated attacker is the scoring case. Check the advisory for any conditions that apply to your configuration.
Where do I find the fixed version?
In the Liferay known vulnerabilities page for CVE-2025-43766. The record itself lists only affected ranges.
Sources
Last reviewed: 18 October 2026.
