GitHub Advisoryadvisory · Maven

GHSA-56qj-wp5r-mvhj Liferay Portal Unvalidated File Upload

MEDIUM Published 2025-08-20 Modified 2025-12-20 Official page ↗
Aliases
CVE-2025-43750
Ecosystem
Maven
Packages
com.liferay:com.liferay.dynamic.data.mapping.form.web
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Weaknesses
CWE-434
Reviewed
2025-08-20

Affected packages

• Maven com.liferay:com.liferay.dynamic.data.mapping.form.web: < 4.0.180 → fixed in 4.0.180

Description

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows remote unauthenticated users (guests) to upload files via the form attachment field without proper validation, enabling extension obfuscation and bypassing MIME type checks.

Related

Alias · CVE (1)

  • CVE-2025-43750 Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through… vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References