CVE-2021-33990

CRITICAL

Liferay Portal 6.2.5 - OS Command Injection via File Upload Request

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2021-33990. PoCs published by Fu2x2000.

AI-analyzed exploit summary This script checks for the presence of a vulnerable Liferay Portal endpoint by sending a GET request to a specific URL. It does not exploit the vulnerability but confirms its existence based on the HTTP response status code.

Description

Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. NOTE: The vendor disputes this issue because the exploit reference link only shows frmfolders.html is accessible and does not demonstrate how an unauthorized user can upload a file.

Exploits (1)

exploitdb SCANNER
by Fu2x2000 · pythonwebappsjava
https://www.exploit-db.com/exploits/51244

This script checks for the presence of a vulnerable Liferay Portal endpoint by sending a GET request to a specific URL. It does not exploit the vulnerability but confirms its existence based on the HTTP response status code.

Classification
Scanner 80%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Liferay Portal 6.2.5 or later
No auth needed
Prerequisites: Access to the target URL
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.1192
EPSS Percentile 95.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-78 CWE-281
Status published
Products (1)
liferay/liferay_portal 6.2.5
Published Apr 16, 2023
Tracked Since Feb 18, 2026