N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-43762

CVE-2025-43762: Liferay Portal users can upload an unlimited amount of files

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allow users to upload an unlimited amount of files through the forms, the files are stored in the document_library allowing an attacker to cause a potential DDoS.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-43762

CVE-2025-43762:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay:com.liferay.dynamic.data.mapping.form.web	maven	< 4.0.180	4.0.180
com.liferay:com.liferay.dynamic.data.mapping.form.field.type	maven	< 6.0.187	6.0.187

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows users to upload an unlimited number of files through forms, leading to potential resource exhaustion and a Denial of Service (DoS) attack. The root cause is the lack of a mechanism to clean up or replace temporary files uploaded to a form field before the form is submitted.

The analysis of the provided patch (commit 9d32b089f30a42c8fd2d30832b3c90eefb5afe84) reveals the exact point of failure and the subsequent fix.

The key modified file is UploadFileEntryMVCActionCommand.java. Within this file, the inner class DDMFormUploadFileEntryHandler contains the upload method, which is responsible for processing the file upload. The patch adds a crucial piece of logic at the beginning of this method: a call to a new utility function, DLFileEntryUtil.deleteDLFileEntry. This new logic ensures that any file previously uploaded to that specific form field instance (oldFileEntryId) is deleted before the new file is processed and stored.

Before this change, the upload function would simply add new files to the document library without removing the old ones associated with the form field. This allowed for the accumulation of orphaned files if the user uploaded a file, then uploaded another to the same field, or simply navigated away from the page without submitting the form.

The newly added DeleteFileEntryMVCActionCommand.java and the corresponding frontend JavaScript changes in DocumentLibrary.es.js provide the necessary infrastructure to handle this deletion, both when a new file is uploaded and when the user navigates away from the page. However, the vulnerable function is the one that improperly handled the resource allocation, which is UploadFileEntryMVCActionCommand$DDMFormUploadFileEntryHandler.upload.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.