CVE-2025-3586
1 advisory.
Maven/com.liferay:com.liferay.object.service CVE-2025-3586: high 7.2
Liferay Portal and DXP Instance Admin can execute code using Objects Actions and Validations
Action: Upgrade com.liferay:com.liferay.object.service to 1.0.96 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.0.96 | - |
Fixed versions
| 1.0.96 |
Sources
- osv: GHSA-m5gv-vj3f-6v2p
- https://nvd.nist.gov/vuln/detail/CVE-2025-3586
- https://github.com/liferay/liferay-portal/commit/3b9e3bb1462ccd33ede05f73f45b38b8262f018f
- https://github.com/liferay/liferay-portal/commit/79ddc243e60864c0c30cfccb1cc46e705e922cb0
- https://github.com/liferay/liferay-portal/commit/b2aa19be228fb308ebe8ae1f47d3224e1fd06225
- https://github.com/liferay/liferay-portal
- https://liferay.atlassian.net/browse/LPE-17586
- https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3586
CVE-2025-3586 · published · modified · JSON