N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-43749

CVE-2025-43749: Liferay Portal Unauthenticated File Access via URL

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows unauthenticated users (guests) to access via URL files uploaded in the form and stored in document_library

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-43749

CVE-2025-43749:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay.portal:release.portal.bom	maven	>= 7.4.0-ga1, <= 7.4.3.132-ga132

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows unauthenticated users to access files uploaded through forms. My analysis of the provided patches pinpoints the exact location of the flaw. The commit 5919534a979a97444172f49705b7a224e372e625 introduces a fix by removing guest permissions on uploaded files.

The investigation focused on the modified file UploadFileEntryMVCActionCommand.java. Two key functions were identified:

com.liferay.dynamic.data.mapping.form.web.internal.portlet.action.UploadFileEntryMVCActionCommand.doProcessAction: This is the main action command that gets triggered upon file upload. It's the entry point for the vulnerable operation. A runtime profiler would show this function in the stack trace during exploitation.
com.liferay.dynamic.data.mapping.form.web.internal.portlet.action.UploadFileEntryMVCActionCommand$DDMFormUploadFileEntryHandler.addFileEntry: This inner class method contains the core logic flaw. It's responsible for adding the file to the repository. Before the patch, it failed to restrict guest access. The patch directly modifies this function to remove the VIEW permission for the GUEST role, thus remediating the vulnerability.

The root cause is improper default permissions being applied to uploaded files, making them world-readable. The identified functions are critical runtime indicators for this vulnerability, as they are directly involved in the file upload process and the application of security permissions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.