CVE-2025-3594 is a critical (CVSS 9.8) path traversal in Liferay Portal 7.0.0 through 7.4.3.4 and Liferay DXP 7.4 GA and 7.3, in the Xuggler download and install feature. Upgrade beyond the affected range and confirm the exact fixed release in Liferay's advisory.
What's affected
Per the record, the affected products are:
- Liferay Portal 7.0.0 through 7.4.3.4
- Liferay DXP 7.4 GA
- Liferay DXP 7.3 GA through update 34
- Older unsupported versions of DXP
The weak spot is the download and installation of Xuggler, reached through the Server Administration portlet, using the jarName parameter. The record says a remote attacker could (1) add files to arbitrary locations on the server and (2) download and execute arbitrary files from the download server.
The record does not name a fixed version. The Liferay advisory page linked from the record did not render usable content when we fetched it, so open the advisory in your browser and read the fixed releases listed there. The record does not flag the flaw as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
How to check if you're exposed
- Find your version. In the Liferay control panel open the About information, or read the release notes file in your installation directory.
- Compare it with the ranges above. Anything from Portal 7.0.0 to 7.4.3.4 is inside the range, as are the DXP lines listed.
- Check who can reach the Server Administration area. It should be limited to a small number of administrators and, ideally, to a management network.
- Review web logs for requests to the Server Administration portlet that mention Xuggler, and unexpected jar files on the server.
- Use the free in-browser dependency scan at gold.safeguard.sh/scan for libraries in your custom modules, and look the CVE up in the Gold directory.
What to do now
- Read the Liferay security advisory for CVE-2025-3594 and note the fixed release for your line.
- Plan an upgrade to a supported release at or above that fix. If you are on an older unsupported DXP line, the move is larger, so schedule it now.
- Until then, limit access to the control panel and the Server Administration portlet with network rules.
- Review the accounts that hold administrator roles, and remove any that are not needed.
- Inspect the file system for files you did not place, mainly in application and library folders.
- Make sure the application server runs as a low privilege user, so a file write has limited reach.
Why it matters
The class is CWE-22, improper limitation of a pathname to a restricted directory, known as path traversal. A parameter that should name a file is trusted to decide where a file lands, and the code does not keep it within its folder.
Here the effect is stronger than a plain read. The record says an attacker can place files in arbitrary locations and also fetch and run files from a download server. That is a path to code execution on the portal host, which explains the 9.8 score.
Portals sit on the edge of a network and often hold user data and integrations with internal systems. Reducing who can reach admin functions cuts risk even before you patch.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which Liferay versions does the record list?
Portal 7.0.0 through 7.4.3.4, DXP 7.4 GA, DXP 7.3 GA through update 34, and older unsupported versions.
Where do I find the fixed version?
In Liferay's security advisory for CVE-2025-3594. The record itself does not list one, so confirm it there.
Sources
Last reviewed: 18 October 2026.
