CVE-2025-43758: Medium severity Liferay portal vulnerability
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows unauthenticated users (guests) to access via URL files uploaded by object entry and stored in documentlibrary
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43758?
CVE-2025-43758 is categorized as a significant security vulnerability due to its impact on unauthenticated file uploads by guests.
How do I fix CVE-2025-43758?
To remediate CVE-2025-43758, upgrade Liferay Portal to version 7.4.3.133 or later and Liferay DXP to versions beyond the affected release specified.
Who is affected by CVE-2025-43758?
CVE-2025-43758 affects users of Liferay Portal versions 7.4.0 through 7.4.3.132 and Liferay DXP across various specified versions.
What is the impact of CVE-2025-43758?
The vulnerability allows unauthenticated users to upload files via URL, potentially leading to unauthorized access or data exposure.
When was CVE-2025-43758 reported?
CVE-2025-43758 was disclosed on a date consistent with the identified vulnerabilities in Liferay's software versions.