CVE-2025-62275: Medium severity Liferay Liferay Portal vulnerability
Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions does not check permission of images in a blog entry, which allows remote attackers to view the images in a blog entry via crafted URL.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62275?
CVE-2025-62275 is classified as a critical vulnerability due to its potential for unauthorized access to blog images.
How do I fix CVE-2025-62275?
To fix CVE-2025-62275, ensure that your Liferay Portal is updated to a patched version beyond 7.4.3.111 or Liferay DXP beyond the affected versions.
What versions are affected by CVE-2025-62275?
CVE-2025-62275 affects Liferay Portal versions 7.4.0 to 7.4.3.111, older unsupported versions, and specific versions of Liferay DXP 2023.
Can CVE-2025-62275 be exploited remotely?
Yes, CVE-2025-62275 can be exploited by remote attackers to access blog images without proper permissions.
What components of Liferay are impacted by CVE-2025-62275?
CVE-2025-62275 impacts the blogs feature in both Liferay Portal and Liferay DXP.