CVE-2025-3586: 
Java vulnerability analysis and mitigation

CVE-2025-3586 is a security vulnerability discovered in Liferay Portal and Liferay DXP affecting versions 7.4.3.27 through 7.4.3.42, and various DXP versions from 2023.Q3.1 through 2024.Q1.20. The vulnerability was disclosed on September 1, 2025, and involves the Objects module not restricting the use of Groovy scripts in Object actions for Admin Users (Liferay Security, NVD).

The vulnerability is classified with a CVSS v4.0 score of 7.5 (HIGH) with the vector string CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The issue stems from incorrect authorization (CWE-863) in the Objects module, where the system fails to properly restrict the use of Groovy scripts in Object actions (NVD).

The vulnerability allows remote authenticated admin users with the Instance Administrator role to execute arbitrary Groovy scripts, effectively enabling remote code execution through Object actions. This poses significant security risks, particularly in self-hosted environments (Liferay Security).

The vulnerability has been fixed in Liferay Portal version 7.4.3.43 and Liferay DXP versions 2024.Q2.0 and 2024.Q3.0. Starting from Liferay DXP 2024.Q2 and later, a new feature has been introduced in Instance Settings that allows administrators to configure whether Groovy scripts are allowed in their instances. In Liferay DXP (Liferay SaaS), the use of Groovy in Object actions is not allowed by default (Liferay Security).