N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-43758

CVE-2025-43758: Liferay Portal's unauthenticated users can access loaded files via URL before submitting the object entry

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows unauthenticated users (guests) to access via URL files uploaded by object entry and stored in document_library

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-43758

CVE-2025-43758:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay:com.liferay.frontend.js.web	maven	< 5.0.125	5.0.125
com.liferay:com.liferay.object.dynamic.data.mapping.form.field.type	maven	< 1.0.65	1.0.65
com.liferay:com.liferay.object.web	maven	< 1.0.219	1.0.219

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows unauthenticated users to access files uploaded via an object entry before the entry is submitted. This is due to two main issues, addressed by the two commits.

First, on the backend, the com.liferay.object.web.internal.deployer.ObjectDefinitionDeployerImpl.upload method, which handles the file upload process, was not correctly setting permissions on the temporary files it created. Specifically, it did not remove the default DOWNLOAD permission for the GUEST role. This meant that anyone with the direct URL to the temporary file could download it, even if they were not logged in. The patch ff4efcb59b6b9acf548d37787b8d4b3d1126fff8 fixes this by explicitly removing the DOWNLOAD permission for the GUEST role immediately after the temporary file is created.

Second, on the frontend, the FileContainer React component was rendering a download link for these temporary files for all users, including unauthenticated guests. This made it easy for guest users to obtain the direct URL to the vulnerable files. The patch bf036898c413b6733918f4bfeba59896f1abb34a addresses this by adding a check (Liferay.ThemeDisplay.isSignedIn()) to ensure the download link is only displayed to authenticated users.

Therefore, both the backend upload method and the frontend FileContainer component are considered vulnerable as they were both necessary components in enabling this security flaw.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.