CVE-2025-43808: Liferay DXP Information Disclosure Flaw

CVE-2025-43808 Overview

CVE-2025-43808 is an improper access control vulnerability [CWE-732] in the Commerce component of Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw affects Liferay Portal versions 7.3.0 through 7.4.3.112 and multiple Liferay DXP release trains. Virtual products uploaded to Documents and Media are saved with guest view permission by default. Remote, unauthenticated attackers can access and download these virtual products for free by crafting URLs that reference the stored assets. The issue undermines the commerce entitlement model on affected portals.

Critical Impact
Unauthenticated remote attackers can download paid virtual products from Liferay Commerce sites through crafted URLs, bypassing purchase controls and causing revenue loss.

Affected Products

Liferay Portal 7.3.0 through 7.4.3.112
Liferay DXP 2023.Q4.0 through 2023.Q4.8 and 2023.Q3.1 through 2023.Q3.10
Liferay DXP 7.4 GA through update 92 and 7.3 SP3 through update 35

Discovery Timeline

2025-09-19 - CVE-2025-43808 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43808

Vulnerability Analysis

The Liferay Commerce component uses Documents and Media as the storage backend for virtual product files. When a merchant uploads a virtual product, the resulting DLFileEntry is persisted with a permission set that includes the guest role's view permission. Any request for the file's direct URL bypasses the commerce checkout, order, and entitlement logic that normally gate downloads.

The vulnerability is an authorization flaw rather than a code execution issue. Attack complexity is low and no user interaction is required. Exploitation impacts confidentiality of paid digital goods and merchant revenue, while integrity and availability of the platform remain unaffected.

Root Cause

The root cause is incorrect default permission assignment when the Commerce module writes virtual product assets to Documents and Media. The guest role receives VIEW on the file entry, which allows anonymous HTTP access. The Commerce entitlement layer, which validates that a user has purchased the product before delivering the file, is never consulted for direct asset URLs.

Attack Vector

An attacker enumerates or harvests the Documents and Media URL of a virtual product, for example through product pages, previews, sitemap resources, or predictable file entry identifiers. The attacker then issues an unauthenticated HTTP GET request against the crafted URL. Because guest view permission is present on the file entry, Liferay serves the file directly, without invoking commerce order validation. No credentials, tokens, or session state are required.

Detection Methods for CVE-2025-43808

Indicators of Compromise

Unauthenticated GET requests to /documents/ or /o/headless-delivery/ paths that resolve to files linked to Commerce virtual products.
High volumes of successful downloads from a single IP address without corresponding commerce order records.
Access log entries showing guest sessions retrieving DLFileEntry identifiers tied to priced catalog items.

Detection Strategies

Correlate web server access logs with the Commerce order database to identify downloads that lack a matching paid order.
Query the DLFileEntry and ResourcePermission tables for virtual product files that grant VIEW to the guest role.
Alert on scraping patterns, such as sequential access to Documents and Media identifiers from unauthenticated clients.

Monitoring Recommendations

Enable audit logging on Documents and Media downloads and forward events to a centralized SIEM for correlation with commerce transactions.
Track anomalous spikes in traffic to product download endpoints and baseline expected download volumes per SKU.
Review permission changes on Commerce-linked file entries and alert when guest view permission is added.

How to Mitigate CVE-2025-43808

Immediate Actions Required

Apply the Liferay-provided fix by upgrading to a patched Portal or DXP release listed in the vendor advisory.
Audit existing Commerce virtual product file entries and remove the guest VIEW permission where it is not required.
Restrict access to the Documents and Media library for Commerce assets to authenticated roles tied to purchase entitlements.

Patch Information

Liferay has published remediation guidance in its security advisory. Refer to the Liferay Known Vulnerabilities CVE-2025-43808 advisory for fixed versions across Portal 7.3, 7.4, and DXP 2023.Q3 and 2023.Q4 release trains, and follow the vendor's upgrade instructions for your deployment channel.

Workarounds

Move Commerce virtual product files into a dedicated Documents and Media folder that denies the guest role and require authenticated download through the Commerce entitlement APIs.
Place a reverse proxy or web application firewall rule in front of /documents/ paths that enforces authentication for Commerce-linked resources.
Rotate URLs of currently exposed virtual products after removing guest permissions to invalidate any previously harvested links.

bash

# Example: remove guest VIEW permission from a Commerce file entry via Liferay's JSON API
curl -u admin:PASSWORD -X POST \
  "https://portal.example.com/api/jsonws/permission/set-individual-resource-permissions" \
  -d "groupId=GROUP_ID" \
  -d "companyId=COMPANY_ID" \
  -d "name=com.liferay.document.library.kernel.model.DLFileEntry" \
  -d "primKey=FILE_ENTRY_ID" \
  -d "roleIdsToActionIds={\"GUEST_ROLE_ID\":[]}"