PT-2025-32666 · Liferay · Liferay Portal+1

Published 2025-08-12 · Updated 2025-08-12 · CVE-2025-43736

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/RE:L

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.3.0 through 7.4.3.132 Liferay DXP versions 2025.Q1.0 through 2025.Q1.8 Liferay DXP versions 2024.Q4.0 through 2024.Q4.7 Liferay DXP versions 2024.Q3.0 through 2024.Q3.13 Liferay DXP versions 2024.Q2.0 through 2024.Q2.13 Liferay DXP versions 2024.Q1.1 through 2024.Q1.16 Liferay Portal versions 7.4 GA through update 92

Description: A Denial Of Service via File Upload (DOS) vulnerability exists due to the ability to upload profile pictures exceeding the maximum allowed size of 300kb. Uploading files larger than this limit can cause performance degradation in Liferay Portal and DXP.

Recommendations: Liferay Portal versions 7.4.3.0 through 7.4.3.132: Limit profile picture uploads to a maximum size of 300kb. Liferay DXP versions 2025.Q1.0 through 2025.Q1.8: Limit profile picture uploads to a maximum size of 300kb. Liferay DXP versions 2024.Q4.0 through 2024.Q4.7: Limit profile picture uploads to a maximum size of 300kb. Liferay DXP versions 2024.Q3.0 through 2024.Q3.13: Limit profile picture uploads to a maximum size of 300kb. Liferay DXP versions 2024.Q2.0 through 2024.Q2.13: Limit profile picture uploads to a maximum size of 300kb. Liferay DXP versions 2024.Q1.1 through 2024.Q1.16: Limit profile picture uploads to a maximum size of 300kb. Liferay Portal versions 7.4 GA through update 92: Limit profile picture uploads to a maximum size of 300kb.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2025-43736

GHSA-CG99-M88X-422C

Affected Products

Liferay Dxp

Liferay Portal

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-43736 · Security Note
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43736 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-43736 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cg99-m88x-422c · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/ab8932bee29df7df377c468f662d55e624d9390d · Note
• https://liferay.atlassian.net/browse/LPE-18220 · Note
• https://t.me/cveNotify/131788 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1955232241044353160 · Twitter Post
• https://twitter.com/CVEnew/status/1955226537080279272 · Twitter Post