Liferay Portal and DXP File Upload Vulnerability Allowing Extension Obfuscation and MIME Type Bypass

A vulnerability exists in Liferay Portal versions 7.4.0 to 7.4.3.132 and in Liferay DXP across several 2024 and 2025 releases, as well as in Liferay DXP 7.4. This vulnerability allows remote unauthenticated users (guests) to upload files through the form attachment field without adequate validation. This lack of proper checks enables users to obfuscate file extensions and bypass MIME type restrictions.

Impact

Exploitation of this vulnerability could lead to unauthorized file uploads that circumvent standard MIME type validations, potentially allowing malicious files to be uploaded and executed or processed inappropriately.

Remediation

Users can upgrade to Liferay Portal's master branch or Liferay DXP 2025.Q2.0 or 2025.Q1.2 to address this vulnerability.