CVE-2025-62276
NoneLiferay Portal and DXP use an incorrect cache-control header
CVSS
—
EPSS
0.1%
Published
Nov 1, 2025
CISA due date
—
The record
The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions uses an incorrect cache-control header, which allows local users to obtain access to downloaded files via the browser's cache.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | com.liferay.portal:com.liferay.portal.impl | 0 | 69.1.0 |
| Maven | com.liferay:com.liferay.adaptive.media.web | 0 | 5.0.52 |
Related vulnerabilities
- GHSA-6533-fhr2-f38h Liferay Portal and DXP use an incorrect cache-control header Same vulnerability
- GHSA-xcj6-xpjg-c4xr Liferay Portal Stores Password Reset Tokens in Plain Text Also affects com.liferay.portal:com.liferay.portal.impl
- CVE-2025-62261 Liferay Portal Stores Password Reset Tokens in Plain Text Also affects com.liferay.portal:com.liferay.portal.impl
- GHSA-q95h-87j6-273x Liferay Portal ComboServlet denial of service via large file combination Also affects com.liferay.portal:com.liferay.portal.impl
- CVE-2025-62254 Liferay Portal ComboServlet denial of service via large file combination Also affects com.liferay.portal:com.liferay.portal.impl
- CVE-2026-96369 Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform… CWE-525
- CVE-2026-87940 Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key… CWE-525
- CVE-2026-13697 undici's cache interceptor mishandles malformed Cache-Control private directives. CWE-525