Liferay Portal Path Traversal Vulnerability via the Hypermedia REST APIs Module

HIGH 7.5CVE-2022-28981 · GHSA-5j86-vmpx-42pc · Published 22/09/2022 · updated 09/07/2026

In short

CVE-2022-28981 is a HIGH (CVSS 7.5) vulnerability affecting com.liferay:com.liferay.headless.discovery.web, liferay portal (liferay).
Chance of exploitation in the next 30 days (EPSS): 1.3%, higher than 70.1% of all vulnerabilities.
Fix: update to 4.0.12 or later.

Package	Affected versions	Patched versions
com.liferay:com.liferay.headless.discovery.web Maven	`< 4.0.12`	`4.0.12`
liferay portal liferay	`≥ 7.4.0, ≤ 7.4.2`	No fix yet

Description

Path traversal vulnerability in the Hypermedia REST APIs module before 4.0.12 from Liferay Portal (7.4.0 through 7.4.2) allows remote attackers to access files outside of com.liferay.headless.discovery.web/META-INF/resources via the parameter parameter.

NVD description

Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access files outside of com.liferay.headless.discovery.web/META-INF/resources via the `parameter` parameter.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free