CVE-2025-62275: Liferay DXP Information Disclosure Flaw

CVE-2025-62275 Overview

CVE-2025-62275 is an authorization flaw [CWE-863] in the Blogs component of Liferay Portal and Liferay Digital Experience Platform (DXP). The application fails to check permissions on images embedded in blog entries. Remote unauthenticated attackers can view restricted blog images by crafting a direct URL to the image resource.

Affected versions include Liferay Portal 7.4.0 through 7.4.3.111, Liferay DXP 2023.Q4.0 through 2023.Q4.10, Liferay DXP 2023.Q3.1 through 2023.Q3.10, Liferay DXP 7.4 GA through update 92, and older unsupported releases. The vulnerability leaks confidentiality but does not affect integrity or availability.

Critical Impact
Unauthenticated remote attackers can retrieve images from access-controlled blog entries via crafted URLs, bypassing intended permission checks.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.111 (and older unsupported versions)
Liferay DXP 2023.Q4.0 through 2023.Q4.10 and 2023.Q3.1 through 2023.Q3.10
Liferay DXP 7.4 GA through update 92 (and older unsupported versions)

Discovery Timeline

2025-11-01 - CVE-2025-62275 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62275

Vulnerability Analysis

The Blogs application in Liferay Portal serves image assets referenced within blog entries. When rendering or delivering these images, the component does not evaluate the permission model that governs access to the parent blog entry or the image resource itself. An attacker who knows or can guess the image URL retrieves the file directly, regardless of whether the blog is restricted to specific users, roles, or sites.

The weakness is classified as Incorrect Authorization [CWE-863]. Confidentiality is impacted at a low level because only image content is exposed. Integrity and availability of the platform remain unaffected. The Exploit Prediction Scoring System (EPSS) probability is 0.267%, reflecting a low but non-zero likelihood of near-term exploitation.

Root Cause

The root cause is a missing authorization check on image retrieval within the Blogs module. The image serving logic trusts the request without validating that the requesting principal has VIEW permission on the associated blog entry.

Attack Vector

Exploitation requires only network access to the Liferay portal. No authentication, no privileges, and no user interaction are needed. An attacker crafts a URL referencing the image identifier associated with a target blog entry and issues an HTTP GET request. The server returns the image bytes without evaluating the caller's permissions.

No public proof-of-concept or exploit code is currently listed for CVE-2025-62275. See the Liferay Security Advisory for vendor guidance.

Detection Methods for CVE-2025-62275

Indicators of Compromise

Unauthenticated HTTP GET requests to Blogs image endpoints (paths containing /blogs/ and image identifiers) from external IP addresses.
Repeated sequential or enumeration-style requests targeting numeric blog or image identifiers.
Requests to image URLs originating from clients that never authenticated or established a session cookie.

Detection Strategies

Review web server and reverse proxy access logs for anonymous requests to Blogs image resources, comparing against the intended visibility of the referenced entries.
Correlate image requests with session state to identify unauthenticated access to images belonging to restricted sites or private blogs.
Alert on high-volume enumeration patterns against Liferay Blogs endpoints.

Monitoring Recommendations

Ingest Liferay application, access, and audit logs into a centralized analytics platform for retention and query.
Track the running Liferay Portal or DXP version against the fixed releases published in the vendor advisory.
Baseline normal request patterns to Blogs endpoints and alert on deviations sourced from anonymous clients.

How to Mitigate CVE-2025-62275

Immediate Actions Required

Identify all Liferay Portal and DXP deployments and confirm their exact version and update level against the affected ranges.
Apply the fix or patch referenced in the Liferay Security Advisory for CVE-2025-62275.
Audit blog entries containing sensitive imagery and rotate or remove images that must not be publicly viewable until patching completes.

Patch Information

Liferay has published guidance for CVE-2025-62275 on its known vulnerabilities portal. Administrators should upgrade Liferay Portal 7.4 to a fixed maintenance release and Liferay DXP customers should apply the corresponding quarterly release or update level indicated in the advisory. Unsupported versions do not receive fixes and must be upgraded to a supported release line.

Workarounds

Restrict network-level access to Liferay Blogs image endpoints for unauthenticated clients using a reverse proxy or web application firewall rule.
Temporarily remove sensitive images from blog entries or replace them with non-confidential placeholders until the patch is deployed.
Enforce authenticated-only access to the portal at the perimeter where the business model allows it.

bash

# Example reverse proxy rule (NGINX) requiring authentication cookie
# for Blogs image requests until the vendor patch is applied
location ~* /documents/.*/blogs/ {
    if ($http_cookie !~* "JSESSIONID") {
        return 403;
    }
    proxy_pass http://liferay_backend;
}