What’s Vulnerable › Vulnerabilities
CVE-2025-43808
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-09-19 · updated 2026-10-18
- Weakness: CWE-732
Description
The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and 7.3 service pack 3 through update 35 saves virtual products uploaded to Documents and Media with guest view permission, which allows remote attackers to access and download virtual products for free via a crafted URL.
Affected products
- Liferay Digital Experience Platform: from 2023.Q3.1 through 2023.Q3.10; from 2023.Q4.0 before 2023.Q4.9; 7.3-service_pack_3, 7.3-update1, 7.3-update10, 7.3-update11, 7.3-update12, 7.3-update13 (+124) — fixed in 2023.Q4.9
- Liferay Portal: from 7.4.0 before 7.4.3.113 — fixed in 7.4.3.113
How to fix
Upgrade to a fixed version: Liferay Digital Experience Platform 2023.Q4.9; Liferay Portal 7.4.3.113. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-43808 or the next vulnerability affects your stack