CVE-2025-62275 json
Liferay Portal and DXP do not check permissions of images in a blog entry
published last yr. modified 22d ago also GHSA-xf7m-v66q-76w8 , EUVD-2025-37410
- cvss
- 5.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 21%
- public exploits
- 0
- none known
Summary
Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions does not check permission of images in a blog entry, which allows remote attackers to view the images in a blog entry via crafted URL.
Patch / fix
- maven com.liferay:com.liferay.blogs.item.selector.web 6.0.19
- liferay liferay_portal 7.4.3.112
Is CVE-2025-62275 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.liferay:com.liferay.blogs.item.selector.web | <6.0.19 |
6.0.19 |
Affected products
- Liferay Portal
- Liferay DXP
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
github.com
/liferay/liferay-portal/commit/9856c55bcbb3b8ce1276117709b9c0082a19c62c
web
-
github.com
/liferay/liferay-portal/commit/e0ae29cfdb8d10a6fddc56d04ca3ae88c3fbc7f3
web
-
liferay.dev
/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62275
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-62275
advisory
-
github.com
/liferay/liferay-portal
package
-
liferay.atlassian.net
/browse/LPE-17948
web
Sources
- CVE List CVE-2025-62275
- GitHub Advisory GHSA-xf7m-v66q-76w8
- NVD CVE-2025-62275
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.