What is CVE-2025-3594?

CVE-2025-3594 is a critical-severity vulnerability in Liferay Digital Experience Platform, classified under Path Traversal. CVSS score: 9.8/10. Published 2025-06-16.

How severe is CVE-2025-3594?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Path Traversal in Liferay Digital Experience Platform

CVE-2025-3594

Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 34, and older unsupported versions allows remote attackers to (1) add files to arbitrary locations on the server and (2) download and execute arbitrary files from the download server via the `_com_liferay_server_admin_web_portlet_ServerAdminPortlet_jarName` parameter.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.006 (44.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Liferay Digital_experience_platform — versions 7.3, 7.4
Liferay Dxp — versions 6.2.0, 7.0.10, 7.1.10
Liferay Liferay_portal — versions 6.2
Liferay Portal — versions 7.0.0

Weakness classification (CWE)

CWE-22 — Path Traversal

References

security@liferay.com (Vendor Advisory)

Frequently asked questions

What is CVE-2025-3594?: CVE-2025-3594 is a critical-severity vulnerability in Liferay Digital Experience Platform, classified under Path Traversal. CVSS score: 9.8/10. Published 2025-06-16.
How severe is CVE-2025-3594?: Critical severity. CVSS v3 base score is 9.8 out of 10.