com.liferay/com.liferay.headless.batch.engine.impl vulnerabilities

Latest com.liferay/com.liferay.headless.batch.engine.impl CVEs

Newest publication first

1. CVE-2025-43806 Liferay Portal and DXP does not properly check permission with import and export tasks

   Published 2025-09-22

   Medium·CVSS 5.3 EPSS 0.26%

   Batch Engine in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 does not properly check permission with import and export tasks, which allows remote authenticated users to access the e...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.