CVE-2025-43758 is a medium-severity vulnerability affecting multiple versions of Liferay Portal and Liferay DXP, specifically versions 7.4.0 through 7.4.3.132 and various 2024 and 2025 quarterly releases. The vulnerability is categorized under CWE-552, which involves files or directories being accessible to external parties without proper authorization. In this case, unauthenticated users (guests) can access files uploaded via object entries that are stored in the document_library component of the Liferay Portal. This access occurs through direct URL requests, bypassing intended access controls. The vulnerability does not require authentication or privileges, and no user interaction is necessary to exploit it. The CVSS 4.0 base score is 5.3, indicating a medium severity level. The attack vector is network-based (AV:N), with low attack complexity (AC:L), no privileges required (PR:N), and no authentication needed (AT:N). The vulnerability impacts confidentiality (VC:L) but does not affect integrity or availability. The scope is limited to the vulnerable Liferay Portal instances, and no known exploits are currently reported in the wild. The lack of patch links suggests that a fix may not yet be publicly available or is pending release. Overall, this vulnerability allows unauthorized disclosure of potentially sensitive files stored in the document library, which could include internal documents, user data, or other confidential information, depending on the deployment context.

For European organizations using Liferay Portal or Liferay DXP, this vulnerability poses a risk of unauthorized data exposure. Since Liferay is widely used for enterprise content management, intranet portals, and customer-facing websites, sensitive documents stored in the document_library could be exposed to external attackers without authentication. This could lead to leakage of intellectual property, personal data protected under GDPR, or other confidential business information. The exposure of such data can result in reputational damage, regulatory fines, and loss of customer trust. Additionally, attackers could use the disclosed information to facilitate further attacks such as social engineering or targeted phishing. The medium severity rating reflects that while the vulnerability does not allow modification or disruption of services, the confidentiality breach alone can have significant consequences, especially for organizations handling sensitive or regulated data. European organizations with strict data protection obligations must consider this vulnerability a priority to address to maintain compliance and security posture.

1. Immediate mitigation should include restricting public access to the document_library directory via web server configurations or reverse proxies, ensuring that only authenticated and authorized users can access uploaded files. 2. Implement strict access control policies within Liferay Portal to enforce permissions on object entries and associated files. 3. Monitor and audit access logs for unusual or unauthorized file access attempts to detect exploitation attempts early. 4. If possible, temporarily disable or limit file upload features until a patch is available. 5. Coordinate with Liferay support or vendor channels to obtain and apply official patches or updates once released. 6. Employ network segmentation and web application firewalls (WAFs) to filter and block suspicious requests targeting document_library URLs. 7. Conduct a thorough review of stored documents to identify and remove any sensitive files that should not be publicly accessible. 8. Educate administrators and users about the risks of storing sensitive data in publicly accessible locations and enforce data classification policies.