CVE-2025-43736: Liferay DXP File Upload DoS Vulnerability

CVE-2025-43736 is a denial of service vulnerability in Liferay Digital Experience Platform caused by unrestricted file upload sizes. Attackers can upload oversized profile pictures to degrade system performance. This article covers technical details, affected versions, impact, and mitigation strategies.

CVE-2025-43736 Overview

CVE-2025-43736 is a Denial of Service (DoS) vulnerability in Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw exists in the user profile picture upload feature, which fails to enforce the documented 300kb maximum file size limit. An authenticated user can upload profile pictures exceeding this threshold, causing Liferay to consume extra storage and processing resources. Repeated abuse degrades platform performance and impacts availability for legitimate users. The issue is tracked under [CWE-770: Allocation of Resources Without Limits or Throttling].

Critical Impact
Authenticated users can upload oversized profile pictures beyond the 300kb limit, degrading Liferay Portal and DXP performance across affected deployments.

Affected Products

Liferay Portal 7.4.3.0 through 7.4.3.132
Liferay Portal 7.4 GA through update 92
Liferay DXP 2024.Q1.1 through 2024.Q1.16, 2024.Q2.0 through 2024.Q2.13, 2024.Q3.0 through 2024.Q3.13, 2024.Q4.0 through 2024.Q4.7, and 2025.Q1.0 through 2025.Q1.8

Discovery Timeline

2025-08-12 - CVE-2025-43736 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43736

Vulnerability Analysis

The vulnerability resides in the profile picture upload handler within Liferay Portal and DXP. Liferay documents a maximum profile picture size of 300kb, but the server-side code does not enforce this limit. Authenticated users can upload arbitrarily larger images to their user profile. The extra data increases storage utilization, database record sizes, and image-processing overhead. Under sustained abuse, portal responsiveness declines for all users, producing a partial availability impact consistent with a resource-exhaustion pattern.

Root Cause

The root cause is missing input validation on the profile picture upload endpoint. The application accepts files beyond the documented 300kb boundary because size validation is not applied at the request handling layer. This aligns with [CWE-770], where the application allocates storage and processing capacity without throttling the resource consumption per user request.

Attack Vector

Exploitation requires network access to the Liferay portal and an authenticated user account. The attacker submits a profile picture upload request containing a file larger than 300kb through the standard user profile interface. No special privileges or user interaction beyond a valid session are required. Repeated uploads amplify the impact, gradually slowing the portal for legitimate users.

No verified public proof-of-concept code is available. See the Liferay Security Advisory CVE-2025-43736 for vendor-supplied technical details.

Detection Methods for CVE-2025-43736

Indicators of Compromise

Profile picture files stored in Liferay Document Library exceeding 300kb
Unusual growth in the Users_ or Document Library storage tables tied to profile image records
Elevated CPU and memory usage on Liferay nodes correlated with /api/jsonws/user or profile update endpoints
Multiple large multipart/form-data uploads to user profile endpoints from a single account

Detection Strategies

Inspect web server and application access logs for POST requests to user profile endpoints with Content-Length values above 300kb
Query the Liferay database for user portrait records where the stored image size exceeds the documented limit
Monitor Liferay JVM metrics for sustained heap and CPU spikes coinciding with profile image processing

Monitoring Recommendations

Enable WAF rules to log and alert on profile picture uploads above 300kb
Track per-user upload volume and frequency to identify accounts abusing the profile picture feature
Baseline normal image sizes and alert on statistical outliers in the Liferay Document Library

How to Mitigate CVE-2025-43736

Immediate Actions Required

Apply the Liferay-provided fix by upgrading to a patched Portal or DXP release referenced in the vendor advisory
Restrict profile picture upload permissions to trusted user roles until patching is complete
Enforce a 300kb request size limit for profile picture endpoints at the reverse proxy or WAF layer

Patch Information

Liferay has published remediation guidance in the Liferay Security Advisory CVE-2025-43736. Administrators running Liferay Portal 7.4.3.0 through 7.4.3.132, Liferay Portal 7.4 GA through update 92, or any affected DXP quarterly release should follow the vendor advisory to upgrade to a fixed version.

Workarounds

Configure the upstream reverse proxy (for example, NGINX or Apache HTTPD) to reject requests larger than 300kb on profile picture upload paths
Set stricter com.liferay.portal.upload.UploadServletRequestImpl size limits in portal-ext.properties
Temporarily disable end-user profile picture updates through role permissions until the patch is applied

bash

# Example NGINX limit for the Liferay user profile image endpoint
location /image/user_portrait {
    client_max_body_size 300k;
    proxy_pass http://liferay_upstream;
}