What is GHSA-56qj-wp5r-mvhj?

GHSA-56qj-wp5r-mvhj is a security advisory published by GitHub Security Advisories with Medium severity. Liferay Portal Unvalidated File Upload

Which CVE IDs does GHSA-56qj-wp5r-mvhj cover?

GHSA-56qj-wp5r-mvhj covers the following CVE IDs: CVE-2025-43750. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-56qj-wp5r-mvhj?

GHSA-56qj-wp5r-mvhj affects 1 product, including: maven/com.liferay:com.liferay.dynamic.data.mapping.form.web:\u003c 4.0.180.

GHSA-56qj-wp5r-mvhjMedium

Liferay Portal Unvalidated File Upload

Vendor

GitHub Security Advisories

Published

August 20, 2025

Last Modified

December 20, 2025

🔗 CVE IDs covered (1)

CVE-2025-43750 →

📋 Description

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows remote unauthenticated users (guests) to upload files via the form attachment field without proper validation, enabling extension obfuscation and bypassing MIME type checks.

🎯 Affected products1

maven/com.liferay:com.liferay.dynamic.data.mapping.form.web:< 4.0.180

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2025-43750
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43750
https://github.com/liferay/liferay-portal/commit/7f58439723c8373e038d5060d0bc58ff2475bdc5
https://github.com/liferay/liferay-portal/commit/b9e57377cb88bad1775beab50558cc2bd5a9758e
https://liferay.atlassian.net/browse/LPE-18190
https://github.com/advisories/GHSA-56qj-wp5r-mvhj