CVE-2025-62275
NoneLiferay Portal and DXP do not check permissions of images in a blog entry
CVSS
—
EPSS
0.3%
Published
Nov 1, 2025
CISA due date
—
The record
Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions does not check permission of images in a blog entry, which allows remote attackers to view the images in a blog entry via crafted URL.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | com.liferay:com.liferay.blogs.item.selector.web | 0 | 6.0.19 |
Related vulnerabilities
- GHSA-xf7m-v66q-76w8 Liferay Portal and DXP do not check permissions of images in a blog entry Same vulnerability
- CVE-2026-96398 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. CWE-863
- CVE-2026-96384 Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful… CWE-863
- CVE-2026-96370 Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request… CWE-863
- CVE-2026-96373 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. CWE-863
- CVE-2026-96366 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. CWE-863
- CVE-2026-96356 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. CWE-863
- CVE-2026-84917 Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful… CWE-863