CVE-2025-43763: Liferay Portal is vulnerable to SSRF through custom object attachment fields

The analysis of the provided commits clearly indicates that the vulnerability lies within the getOrAddFileEntry method of the AttachmentManagerImpl class. The patches from commits e5fe3f9e9916e66a896e7c321e641c6eabbf4dae and 0adf32842d055f40accc8b341c4feb11a9728261 both target this specific function to add validation logic. The core of the vulnerability is the lack of validation on the companyId of the FileEntry object that is fetched using an externalReferenceCode. This allows an attacker to specify an external reference that points to a resource outside of the intended scope, leading to an SSRF vulnerability. The added code explicitly checks if the companyId of the fetched resource matches the current companyId, thereby closing the security gap. Therefore, any runtime profile capturing the exploitation of this vulnerability would show the com.liferay.object.internal.field.attachment.AttachmentManagerImpl.getOrAddFileEntry function in the stack trace as it is the entry point for processing the malicious input.