Liferay Portal 7.4 ComboServlet DoS via oversized file combos
CVE-2025-62254 Published on October 23, 2025
The ComboServlet in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit the number or size of the files it will combine, which allows remote attackers to create very large responses that lead to a denial of service attack via the URL query string.
Weakness Type
What is a Directory traversal Vulnerability?
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVE-2025-62254 has been classified to as a Directory traversal vulnerability or weakness.
Products Associated with CVE-2025-62254
stack.watch emails you whenever new vulnerabilities are published in Liferay Portal or Liferay Digital Experience Platform. Just hit a watch button to start following.
Affected Versions
Liferay Portal:- Version 7.4.0, <= 7.4.3.111 is affected.
- Version 7.3.10, <= 7.3.10-u35 is affected.
- Version 7.4.13, <= 7.4.13-u92 is affected.
- Version 2023.Q3.1, <= 2023.Q3.5 is affected.
- Version 2023.Q4.0, <= 2023.Q4.2 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.