PT-2025-34478 · Liferay · Liferay Portal+1

Published 2025-08-22 · Updated 2025-12-16 · CVE-2025-43758

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.0 through 7.4.3.132 Liferay DXP versions 2025.Q1.0 through 2025.Q1.5 Liferay DXP versions 2024.Q4.0 through 2024.Q4.7 Liferay DXP versions 2024.Q3.1 through 2024.Q3.13 Liferay DXP versions 2024.Q2.0 through 2024.Q2.13 Liferay DXP versions 2024.Q1.1 through 2024.Q1.15 Liferay DXP 7.4 GA through update 92

Description: The issue allows unauthenticated users (guests) to access files uploaded by object entry and stored in the document library via URL.

Recommendations: Liferay Portal versions 7.4.0 through 7.4.3.132: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Liferay DXP versions 2025.Q1.0 through 2025.Q1.5: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Liferay DXP versions 2024.Q4.0 through 2024.Q4.7: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Liferay DXP versions 2024.Q3.1 through 2024.Q3.13: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Liferay DXP versions 2024.Q2.0 through 2024.Q2.13: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Liferay DXP versions 2024.Q1.1 through 2024.Q1.15: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Liferay DXP 7.4 GA through update 92: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2025-43758

GHSA-MM62-GWJ5-J285

Affected Products

Liferay Dxp

Liferay Portal

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-43758 · Security Note
• https://osv.dev/vulnerability/GHSA-mm62-gwj5-j285 · Vendor Advisory
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43758 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-43758 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/ff4efcb59b6b9acf548d37787b8d4b3d1126fff8 · Note
• https://github.com/liferay/liferay-portal/commit/bf036898c413b6733918f4bfeba59896f1abb34a · Note
• https://twitter.com/CVEnew/status/1958964667004723280 · Twitter Post
• https://t.me/CVEtracker/30719 · Telegram Post
• https://liferay.atlassian.net/browse/LPE-18186 · Note
• https://twitter.com/VulmonFeeds/status/1959108547469266996 · Twitter Post
• https://t.me/cveNotify/145938 · Telegram Post