CVE-2022-28981: Liferay Portal

High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days.

Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access files outside of com.liferay.headless.discovery.web/META-INF/resources via the `parameter` parameter.

Affected products

• Liferay Liferay Portal: from 7.4.0, up to and including 7.4.2

Published 2022-09-22. Last modified 2026-07-09.