CVE-2025-43825: Liferay DXP Information Disclosure Flaw

CVE-2025-43825 Overview

CVE-2025-43825 is an information exposure vulnerability affecting Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw allows sensitive user data to be included in Freemarker templates, enabling an unauthorized actor to access confidential information that should remain restricted. The weakness is categorized under CWE-201: Insertion of Sensitive Information Into Sent Data. Liferay published an advisory covering affected versions across multiple quarterly releases of DXP and Portal 7.4.

Critical Impact
Authenticated actors with high privileges can retrieve sensitive user data rendered through Freemarker templates, exposing confidential information outside intended access boundaries.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.132
Liferay DXP 2024.Q1.1 through 2024.Q1.12, 2024.Q2.1 through 2024.Q2.13, 2024.Q3.0 through 2024.Q3.13, 2024.Q4.0 through 2024.Q4.5, and 2025.Q1.0 through 2025.Q1.4
Liferay DXP 7.4 GA through update 92, 2023.Q3.1 through 2023.Q3.10, and 2023.Q4.0 through 2023.Q4.10

Discovery Timeline

2025-10-03 - CVE-2025-43825 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43825

Vulnerability Analysis

The vulnerability stems from Liferay's handling of Freemarker templates. Freemarker is a Java-based template engine used by Liferay to render dynamic content within portlets, web content, and administrative views. Sensitive user data is included in the template context when it should not be exposed. This allows an actor rendering a template to access user information outside the intended scope.

The issue is classified as an Information Exposure (CWE-201). The attack vector is network-based and requires high privileges and user interaction. Confidentiality impact is limited to low-sensitivity data, with no direct impact on integrity or availability. The EPSS probability is 0.303%, indicating a low likelihood of near-term exploitation activity.

Root Cause

The root cause is overly permissive data binding into the Freemarker template model. User objects passed to the template engine include fields that should be filtered or masked before rendering. Because Freemarker expressions can introspect bound objects, any attribute reachable from the template root becomes accessible to anyone who can author or edit a template.

Attack Vector

Exploitation requires an authenticated account with privileges to create or modify Freemarker templates within Liferay. Such privileges are typically held by administrators, content authors, or site developers. The actor crafts a Freemarker expression that references sensitive attributes of the exposed user object. When the template renders, the engine serializes those attributes into the output. The content is then disclosed to any viewer with access to the rendered page or asset.

No verified public proof-of-concept code is available. See the Liferay Security Advisory CVE-2025-43825 for vendor technical details.

Detection Methods for CVE-2025-43825

Indicators of Compromise

Unexpected Freemarker templates authored or modified by non-administrative accounts within Liferay's template administration areas.
Rendered pages or web content containing user attributes such as email addresses, screen names, or user identifiers that were not part of the original template design.
Audit log entries showing template edits followed by anonymous or low-privilege views of the affected asset.

Detection Strategies

Review Liferay audit logs for Template and DDMTemplate create and update events, correlating author identity with least-privilege expectations.
Scan existing Freemarker templates for expressions referencing user, userLocalService, or related user model attributes that expose personally identifiable information.
Compare template content against a known-good baseline to identify unauthorized references to sensitive object properties.

Monitoring Recommendations

Alert on administrative template edits performed outside approved change windows.
Monitor outbound HTTP responses from Liferay rendering endpoints for patterns matching user email formats or internal identifiers.
Forward Liferay application logs to a centralized analytics platform such as Singularity Data Lake for correlation with endpoint and identity telemetry.

How to Mitigate CVE-2025-43825

Immediate Actions Required

Apply the fixed releases published by Liferay for the affected Portal 7.4 and DXP quarterly branches.
Audit all accounts holding template authoring privileges and remove permissions from users who do not require them.
Review existing Freemarker templates and remove any references to sensitive user attributes.

Patch Information

Liferay has published remediation guidance in the Liferay Security Advisory CVE-2025-43825. Customers should upgrade to the patched quarterly release that corresponds to their current DXP branch, or to a Portal 7.4 release later than 7.4.3.132 that includes the fix.

Workarounds

Restrict Freemarker template creation and editing to a small set of trusted administrators until patches are applied.
Remove or mask sensitive user object attributes referenced in existing templates.
Enable Liferay's template allowlist controls to limit the classes and objects reachable from Freemarker contexts.

bash

# Configuration example
# Restrict template permissions via Liferay portal-ext.properties
# Review and tighten access to template administration
freemarker.engine.restricted.classes=com.liferay.portal.kernel.model.User,com.liferay.portal.kernel.service.UserLocalService