Junglewise Threat Intelligence

CVE-2025-43763: Liferay Portal is vulnerable to SSRF through custom object attachment fields

CVE-2025-43763 · Severity: medium · CVSS 4 · Published 2025-09-09

Technologies: com.liferay:com.liferay.object.service (Maven). Vendors: Maven.

Executive brief

Liferay Portal is vulnerable to SSRF through custom object attachment fields

Affected products

Maven com.liferay:com.liferay.object.service

Related threats

Liferay Portal and DXP Instance Admin can execute code using Objects Actions and Validations
Liferay Portal is vulnerable to Insecure Direct Object Reference (IDOR) attack through Authentication Bypass