CVE-2025-43825: 
Java vulnerability analysis and mitigation

A vulnerability (CVE-2025-43825) was discovered in Liferay Portal 7.4.0 through 7.4.3.132, and multiple versions of Liferay DXP including 2025.Q1.0 through 2025.Q1.4, affecting the Freemarker template functionality. The vulnerability was disclosed on October 3, 2025, and allows sensitive user data to be exposed through the Freemarker template system (Liferay Security).

The vulnerability has been assigned a CVSS v4.0 score of 4.6 (Medium) with the following vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. The weakness is categorized under CWE-201 (Insertion of Sensitive Information Into Sent Data). The vulnerability specifically affects the Freemarker template system's handling of sensitive user data, potentially allowing unauthorized access to confidential information (NVD Database).

The vulnerability allows unauthorized actors to potentially gain access to and render confidential information that should remain restricted. The impact is primarily focused on data confidentiality, with no reported effects on system integrity or availability (Liferay Security).

Fixed versions have been released including Liferay Portal on master branch, Liferay DXP 2024.Q1.13, Liferay DXP 2024.Q4.6, Liferay DXP 2025.Q1.5, and Liferay DXP 2025.Q2.0. Users are advised to upgrade to these patched versions to mitigate the vulnerability (Liferay Security).