CVE-2025-43805 Liferay Portal allows remote attackers to view display page templates via crafted URLs

Medium 6.9 Published 16 Sep 2025 Updated 17 Sep 2025

Remote attackers can view display page templates without authorization due to missing checks in Liferay Portal.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-43805?

CVE-2025-43805 is a medium-severity missing authorization vulnerability in Liferay Digital Experience Platform, published on 16 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35 does not perform an authorization check when users attempt to view a display page template, which allows remote attackers to view display page templates via crafted URLs.

Weakness: CWE-862

Which versions are affected by CVE-2025-43805?

2 open source packages ship an affected version, including com.liferay:com.liferay.asset.display.page.service. It affects 2 products.

Package	Affected	Fixed in
`com.liferay:com.liferay.asset.display.page.service` Maven	All versions	`4.0.55`
`com.liferay:com.liferay.asset.display.page.service` Maven	All versions	`4.0.55`

Products include Liferay Digital Experience Platform, Liferay Liferay Portal.

How do I fix CVE-2025-43805?

Upgrade com.liferay:com.liferay.asset.display.page.service to 4.0.55 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-43805 being exploited?

There is no known exploitation of CVE-2025-43805 in the wild and no public exploit code.

All Liferay Digital Experience Platform vulnerabilities

Sources

Also known as GHSA-5pp7-m8x8-rc82.