{"action":"Upgrade com.liferay:com.liferay.object.service to 1.0.96 or later.","affected":[{"fixed":"1.0.96","introduced":"0"}],"component":"com.liferay:com.liferay.object.service","cve_ids":["CVE-2025-3586"],"ecosystem":"Maven","epss":0.00417,"exploited":false,"fixed_versions":["1.0.96"],"ghsa_id":"GHSA-m5gv-vj3f-6v2p","id":"tcs_01M5N94D5D96TYHKJH194WQ81K","modified_at":"2025-12-12T22:41:15.210315Z","published_at":"2025-12-12T21:31:30Z","references":["https://osv.dev/vulnerability/GHSA-m5gv-vj3f-6v2p","https://nvd.nist.gov/vuln/detail/CVE-2025-3586","https://github.com/liferay/liferay-portal/commit/3b9e3bb1462ccd33ede05f73f45b38b8262f018f","https://github.com/liferay/liferay-portal/commit/79ddc243e60864c0c30cfccb1cc46e705e922cb0","https://github.com/liferay/liferay-portal/commit/b2aa19be228fb308ebe8ae1f47d3224e1fd06225","https://github.com/liferay/liferay-portal","https://liferay.atlassian.net/browse/LPE-17586","https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3586"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"GHSA-m5gv-vj3f-6v2p","url":"https://osv.dev/vulnerability/GHSA-m5gv-vj3f-6v2p"}],"summary":"Liferay Portal and DXP Instance Admin can execute code using Objects Actions and Validations"}