CVE-2025-43750: Liferay DXP File Upload RCE Vulnerability

CVE-2025-43750 Overview

CVE-2025-43750 is an unrestricted file upload vulnerability [CWE-434] affecting Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw resides in the form attachment field, which fails to validate uploaded files. Remote unauthenticated users (guests) can upload files using extension obfuscation techniques and bypass MIME type checks. Affected versions include Liferay Portal 7.4.0 through 7.4.3.132, Liferay DXP 7.4 GA through update 92, and multiple 2024.Q1 through 2025.Q1 quarterly releases.

Critical Impact
Unauthenticated remote attackers can upload arbitrary files to affected Liferay instances by obfuscating file extensions and bypassing MIME type validation, potentially enabling delivery of malicious content to portal users.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.132
Liferay DXP 7.4 GA through update 92
Liferay DXP 2024.Q1.1 through 2025.Q1.1 (quarterly releases)

Discovery Timeline

2025-08-20 - CVE-2025-43750 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43750

Vulnerability Analysis

The vulnerability stems from insufficient validation on the form attachment field in Liferay Portal and Liferay DXP. The application accepts file uploads from unauthenticated guests without enforcing proper file type or content validation. Attackers can leverage extension obfuscation, such as double extensions or embedded null bytes, to disguise executable or malicious file types. The MIME type check applied by the application can be bypassed by manipulating the Content-Type header submitted with the upload request.

Because the endpoint is reachable by guest users, no authentication or session context is required to trigger the upload. The uploaded files are stored server-side and may be served back to legitimate users, expanding the impact to include client-side attacks such as script or HTML content delivery.

Root Cause

The root cause is missing server-side validation of both file extension and file content on the form attachment upload handler. The application trusts client-supplied metadata for file type determination. Deny-list based filtering, if present, is insufficient to prevent obfuscated extensions from reaching the storage layer.

Attack Vector

Exploitation requires only network access to a public-facing Liferay form containing an attachment field. The attacker submits a crafted multipart form request that includes a file with a manipulated filename and a spoofed Content-Type header. See the Liferay Security Advisory CVE-2025-43750 for advisory details. No verified public proof-of-concept is available at this time.

Detection Methods for CVE-2025-43750

Indicators of Compromise

Unusual attachment files stored in Liferay document library folders associated with form submissions, particularly files with double extensions such as .jpg.html or .png.svg.
Multipart upload requests to Liferay form endpoints from unauthenticated sessions containing mismatched Content-Type headers and filename extensions.
Newly created files in the Liferay data directory whose true content type (as determined by magic bytes) does not match the stored filename extension.

Detection Strategies

Inspect web server and application logs for guest-initiated POST requests to form attachment endpoints and correlate with subsequent file creation events.
Deploy web application firewall (WAF) rules that inspect uploaded file magic bytes and reject uploads where declared MIME type conflicts with actual content.
Perform integrity scans of the Liferay document library, flagging files uploaded by guest accounts and files with anomalous extension patterns.

Monitoring Recommendations

Enable verbose logging on Liferay form submission endpoints and forward events to a centralized SIEM for correlation.
Monitor filesystem changes to Liferay data directories using file integrity monitoring to detect unexpected additions.
Track spikes in guest-user form submissions containing attachments as a possible indicator of automated abuse.

How to Mitigate CVE-2025-43750

Immediate Actions Required

Upgrade Liferay Portal to a version beyond 7.4.3.132 and Liferay DXP to a fixed quarterly release as identified in the vendor advisory.
Where patching cannot be performed immediately, restrict guest access to forms containing attachment fields or disable attachment fields on public-facing forms.
Audit the Liferay document library for suspicious files uploaded prior to remediation and quarantine any files with obfuscated extensions.

Patch Information

Liferay has published remediation guidance in the Liferay Security Advisory CVE-2025-43750. Administrators should apply the security update for their specific product line and version series as documented by the vendor.

Workarounds

Configure Liferay to enforce a strict allow-list of permitted file extensions and MIME types for form attachments in portal-ext.properties.
Place a WAF or reverse proxy in front of the Liferay instance to inspect and validate multipart uploads before they reach the application.
Restrict guest permissions on form-related roles so anonymous users cannot submit attachments until patching is complete.

bash

# Configuration example: restrict allowed upload extensions in portal-ext.properties
dl.file.extensions=.pdf,.docx,.xlsx,.png,.jpg
dl.file.max.size=10485760
# Disable guest permissions on form attachment actions via Control Panel > Roles > Guest