Liferay Portal Template RCE Advisory

Liferay Portal often backs intranet, customer, and partner portals where authenticated users may have authoring permissions. CVE-2010-5327 affects Liferay Portal through 6.2.10 when template-engine access controls allow privileged template behavior.

This active check confirms whether user-controlled input or workflow behavior crosses a security boundary. Public docs keep the explanation high-level so customers understand the risk. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.

If an affected Liferay Portal runtime is deployed and an untrusted authenticated user can create or edit Velocity or FreeMarker templates, the template boundary may cross into server-side command execution. A version match should drive runtime patch verification and permission review before it is treated as confirmed compromise.

Apply Liferay's LPS-64547 binary/source patch for the deployed 6.2 CE release line, confirm an equivalent backport, or upgrade to a supported fixed release. Restrict template editing to trusted administrators, review existing templates, and keep portal administration behind trusted-network or authenticated access while rollout completes.