CVE-2025-43749: Liferay DXP Information Disclosure Flaw

CVE-2025-43749 Overview

CVE-2025-43749 affects Liferay Portal and Liferay Digital Experience Platform (DXP). The vulnerability allows unauthenticated users (guests) to access files uploaded through forms and stored in the document_library via direct URL requests. The flaw is classified under [CWE-552: Files or Directories Accessible to External Parties].

Affected releases include Liferay Portal 7.4.0 through 7.4.3.132, Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14, and Liferay DXP 7.4 GA through update 92.

Critical Impact
Unauthenticated attackers can retrieve form-uploaded files from the Liferay document library by requesting their URLs directly.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.132
Liferay DXP 2024.Q1 through 2025.Q1 (multiple quarterly builds)
Liferay DXP 7.4 GA through update 92

Discovery Timeline

2025-08-20 - CVE-2025-43749 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43749

Vulnerability Analysis

The issue resides in how Liferay Portal exposes files that users upload through form widgets. When a form contains a file upload field, the submitted file is stored in the platform's document_library. The affected versions fail to enforce proper access controls on the storage URL, allowing anonymous guest requests to fetch the stored artifacts.

Because form submissions frequently include sensitive material such as identity documents, contracts, or internal attachments, exposure through a predictable or discoverable URL results in confidentiality loss. The attack vector is network based, requires no authentication, and only relies on the attacker obtaining or guessing the file URL.

Root Cause

The vulnerability stems from missing authorization checks on document library resources referenced by form uploads. Liferay treats these files as guest-accessible content rather than gating them behind the same permission model applied to other document library entries. This mismatch corresponds directly to [CWE-552], where sensitive files are made reachable to external parties.

Attack Vector

An unauthenticated attacker obtains a valid file URL for a form-uploaded document, either by referrer leakage, log exposure, enumeration, or shared links. The attacker issues a standard HTTP GET request to that URL against the vulnerable Liferay instance and receives the file content without authentication. See the Liferay Security Advisory CVE-2025-43749 for vendor-provided technical detail.

Detection Methods for CVE-2025-43749

Indicators of Compromise

Anonymous HTTP GET requests to /documents/ or /o/document_library/ paths returning 200 OK without a prior authenticated session
Access log entries showing guest user identifiers retrieving files that originated from form submissions
Unusual referrer-less traffic to document library URLs from external IP ranges

Detection Strategies

Review Liferay access logs for unauthenticated requests to document library paths tied to form workflows
Correlate form submission events with subsequent guest-user download requests targeting the same file identifiers
Flag bursts of sequential document ID access attempts that suggest enumeration of stored form uploads

Monitoring Recommendations

Enable verbose auditing on the Liferay document library and export logs to a centralized analytics platform
Alert on any anonymous session accessing files whose parent folder is associated with form uploads
Track outbound bandwidth from Liferay nodes to identify large-volume exfiltration of stored documents

How to Mitigate CVE-2025-43749

Immediate Actions Required

Upgrade Liferay Portal and DXP to a fixed release listed in the Liferay Security Advisory CVE-2025-43749
Audit the document_library for files uploaded through public forms and restrict their permissions
Rotate or invalidate URLs of any form-uploaded documents containing sensitive data

Patch Information

Liferay has published guidance and fixed builds in its security advisory. Administrators should apply the vendor-supplied patch or move to a supported quarterly release beyond the affected ranges. Refer to the Liferay Security Advisory CVE-2025-43749 for exact fixed version numbers.

Workarounds

Restrict guest role permissions on the document library so anonymous users cannot view files
Place form upload folders inside a private site or a permission-controlled folder that denies the guest role
Front the Liferay instance with a reverse proxy that requires authentication for /documents/ and related endpoints until patching is complete

bash

# Example: restrict guest access to document library paths at the reverse proxy
location ~* ^/(documents|o/document_library)/ {
    auth_request /_auth;
    proxy_pass http://liferay_backend;
}