CVE-2025-43750: 
Java vulnerability analysis and mitigation

CVE-2025-43750 affects Liferay Portal 7.4.0 through 7.4.3.132, and multiple versions of Liferay DXP from 2024.Q1.1 through 2025.Q1.1. The vulnerability was discovered and disclosed on August 20, 2025, allowing remote unauthenticated users (guests) to upload files via the form attachment field without proper validation (Liferay Advisory).

The vulnerability is characterized by insufficient validation in the form attachment field, which enables extension obfuscation and allows bypassing of MIME type checks. The severity is rated as MEDIUM with a CVSS v4.0 score of 5.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N). The weakness is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) (NVD Database).

The vulnerability allows attackers to bypass file upload restrictions through extension obfuscation, potentially leading to the upload of malicious files. This could result in low-level compromise of both confidentiality and integrity of the system (Liferay Advisory).

The vulnerability can be exploited remotely by unauthenticated users, requiring only user interaction for successful exploitation. No special privileges are needed to exploit this vulnerability (NVD Database).

Fixed versions have been released including Liferay Portal on master branch, Liferay DXP 2025.Q2.0, and Liferay DXP 2025.Q1.2. Users are advised to upgrade to these patched versions to mitigate the vulnerability (Liferay Advisory).