CVE-2025-43758: Liferay DXP Information Disclosure Flaw

CVE-2025-43758 Overview

CVE-2025-43758 is an information disclosure vulnerability in Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw allows unauthenticated users (guests) to access files uploaded through object entries and stored in the document_library via direct URL requests. The vulnerability is classified under [CWE-552] Files or Directories Accessible to External Parties.

Affected versions include Liferay Portal 7.4.0 through 7.4.3.132, Liferay Portal 7.4 GA through update 92, and multiple Liferay DXP quarterly releases from 2024.Q1 through 2025.Q1.5. The issue exposes potentially sensitive documents that administrators intended to restrict to authenticated users.

Critical Impact
Unauthenticated attackers can retrieve files uploaded via object entries by requesting the document URL directly, bypassing intended access restrictions on the document_library.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.132
Liferay Portal 7.4 GA through update 92
Liferay DXP 2024.Q1.1 through 2024.Q1.15, 2024.Q2.0 through 2024.Q2.13, 2024.Q3.1 through 2024.Q3.13, 2024.Q4.0 through 2024.Q4.7, and 2025.Q1.0 through 2025.Q1.5

Discovery Timeline

2025-08-22 - CVE-2025-43758 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43758

Vulnerability Analysis

The vulnerability resides in how Liferay Portal handles file uploads associated with object entries. When users create or modify object entries that include file attachments, those files are stored inside the document_library repository. The access control layer for objects does not consistently propagate to the stored document, leaving the underlying file reachable through its direct URL.

Because the document URL can be requested without authentication, an attacker who discovers or guesses a file identifier can retrieve the file contents. This exposes documents that the object entry permissions were intended to protect. The scope of impact depends on what data organizations upload through object entries, which may include internal documents, forms, or attachments containing personal or business information.

The issue affects a wide range of releases across both the community Portal edition and the enterprise DXP product line, indicating the flaw exists in shared object storage logic rather than an edition-specific feature.

Root Cause

The root cause is a missing authorization check on files stored in the document_library when those files originate from object entry uploads. Object-level permissions are enforced when accessing the object entry itself, but the associated file references remain publicly reachable through their direct document URLs.

Attack Vector

Exploitation requires an attacker to interact with the Liferay instance over the network as an unauthenticated guest. User interaction is passive — the attacker only needs a valid document URL or must enumerate one. No credentials, session tokens, or elevated privileges are required. See the Liferay Security Advisory for CVE-2025-43758 for vendor-provided details.

Detection Methods for CVE-2025-43758

Indicators of Compromise

Unauthenticated HTTP GET requests to /documents/ paths originating from unexpected external IPs
Requests to document URLs without a preceding authenticated session cookie or referer from an object entry view
Sequential or enumeration-style access patterns to document identifiers under the document_library

Detection Strategies

Review web server and reverse proxy access logs for high-volume anonymous requests to document endpoints associated with object entries
Correlate document downloads against authentication events to flag file retrievals that occurred without a corresponding authenticated session
Monitor for user agents and IP addresses that access documents without first browsing associated object pages

Monitoring Recommendations

Enable verbose logging on the Liferay document_library access layer to capture file retrieval requests with source IP and authentication context
Configure alerts for anomalous spikes in guest downloads from the document_library path
Feed Liferay application and access logs into a centralized SIEM or data lake for retention and retrospective hunting

How to Mitigate CVE-2025-43758

Immediate Actions Required

Upgrade to a fixed release of Liferay Portal or Liferay DXP as identified in the vendor advisory
Audit content stored in the document_library that was uploaded through object entries to determine potential exposure
Restrict guest access to document endpoints at the reverse proxy or web application firewall until patching is complete

Patch Information

Liferay has published remediation guidance in the Liferay Security Advisory for CVE-2025-43758. Administrators should apply the vendor-supplied fix packs or upgrade to a version outside the affected ranges listed above.

Workarounds

Block unauthenticated requests to /documents/ and related document_library paths using a reverse proxy or web application firewall rule
Reconfigure object entry file fields to route uploads through repositories with explicit access controls where feasible
Require authentication for all document downloads by enforcing session validation at the ingress layer

bash

# Example nginx rule to require authentication on document_library paths
location ~ ^/documents/ {
    if ($http_cookie !~* "JSESSIONID") {
        return 403;
    }
    proxy_pass http://liferay_backend;
}