PT-2025-34041 · Liferay · Liferay Portal+1

Published 2025-08-20 · Updated 2025-12-18 · CVE-2025-43750

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.0 through 7.4.3.132 Liferay DXP versions 2025.Q1.0 through 2025.Q1.1 Liferay DXP versions 2024.Q4.0 through 2024.Q4.7 Liferay DXP versions 2024.Q3.1 through 2024.Q3.13 Liferay DXP versions 2024.Q2.0 through 2024.Q2.13 Liferay DXP versions 2024.Q1.1 through 2024.Q1.19 Liferay Portal 7.4 GA through update 92

Description: The application allows remote unauthenticated users to upload files through the form attachment field without proper validation. This enables extension obfuscation and bypasses MIME type checks.

Recommendations: Liferay Portal versions 7.4.0 through 7.4.3.132: Update to a newer version. Liferay DXP versions 2025.Q1.0 through 2025.Q1.1: Update to a newer version. Liferay DXP versions 2024.Q4.0 through 2024.Q4.7: Update to a newer version. Liferay DXP versions 2024.Q3.1 through 2024.Q3.13: Update to a newer version. Liferay DXP versions 2024.Q2.0 through 2024.Q2.13: Update to a newer version. Liferay DXP versions 2024.Q1.1 through 2024.Q1.19: Update to a newer version. Liferay Portal 7.4 GA through update 92: Update to a newer version.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-43750

GHSA-56QJ-WP5R-MVHJ

Affected Products

Liferay Dxp

Liferay Portal

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-43750 · Security Note
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43750 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-43750 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-56qj-wp5r-mvhj · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/7f58439723c8373e038d5060d0bc58ff2475bdc5 · Note
• https://github.com/liferay/liferay-portal/commit/b9e57377cb88bad1775beab50558cc2bd5a9758e · Note
• https://twitter.com/VulmonFeeds/status/1958245784672969205 · Twitter Post
• https://liferay.atlassian.net/browse/LPE-18190 · Note
• https://t.me/cveNotify/146197 · Telegram Post
• https://t.me/cveNotify/135743 · Telegram Post
• https://twitter.com/CVEnew/status/1958180754242040163 · Twitter Post