VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Nov 1, 2025· Updated Nov 3, 2025

CVE-2025-62275

CVE-2025-62275

Description

Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions does not check permission of images in a blog entry, which allows remote attackers to view the images in a blog entry via crafted URL.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.liferay:com.liferay.blogs.item.selector.webMaven
< 6.0.196.0.19

Affected products

2

Patches

2
e0ae29cfdb8d

LPD-29516 Add FF to decide to disable change of LPD-2816

https://github.com/liferay/liferay-portalmikellorzaJun 27, 2024via ghsa
commit
1 file changed · +7 −0
  • modules/apps/blogs/blogs-item-selector-web/src/main/java/com/liferay/blogs/item/selector/web/internal/display/context/BlogsItemSelectorViewDisplayContext.java+7 −0 modified
    @@ -15,6 +15,7 @@
 import com.liferay.item.selector.ItemSelectorReturnTypeResolverHandler;
 import com.liferay.item.selector.taglib.servlet.taglib.util.RepositoryEntryBrowserTagUtil;
 import com.liferay.portal.configuration.module.configuration.ConfigurationProviderUtil;
+import com.liferay.portal.kernel.feature.flag.FeatureFlagManagerUtil;
 import com.liferay.portal.kernel.module.configuration.ConfigurationException;
 import com.liferay.portal.kernel.portlet.LiferayPortletResponse;
 import com.liferay.portal.kernel.portlet.PortalPreferences;
@@ -147,6 +148,12 @@ public boolean isSearch() {
 	}
 
 	public boolean showDragAndDropZone(ThemeDisplay themeDisplay) {
+		if (FeatureFlagManagerUtil.isEnabled(
+				themeDisplay.getCompanyId(), "LPD-29516")) {
+
+			return true;
+		}
+
 		if (WorkflowDefinitionLinkLocalServiceUtil.hasWorkflowDefinitionLink(
 				themeDisplay.getCompanyId(), themeDisplay.getScopeGroupId(),
 				BlogsEntry.class.getName())) {
9856c55bcbb3

LPD-2816 Do not allow upload blog attachments if workflow is active for blog entries.

https://github.com/liferay/liferay-portalRoberto DíazJan 31, 2024via ghsa
commit
2 files changed · +15 −1
  • modules/apps/blogs/blogs-item-selector-web/src/main/java/com/liferay/blogs/item/selector/web/internal/display/context/BlogsItemSelectorViewDisplayContext.java+14 −0 modified
    @@ -8,6 +8,7 @@
 import com.liferay.blogs.configuration.BlogsFileUploadsConfiguration;
 import com.liferay.blogs.item.selector.criterion.BlogsItemSelectorCriterion;
 import com.liferay.blogs.item.selector.web.internal.BlogsItemSelectorView;
+import com.liferay.blogs.model.BlogsEntry;
 import com.liferay.blogs.service.BlogsEntryLocalService;
 import com.liferay.document.library.kernel.util.DLUtil;
 import com.liferay.item.selector.ItemSelectorReturnTypeResolver;
@@ -22,6 +23,8 @@
 import com.liferay.portal.kernel.portlet.url.builder.PortletURLBuilder;
 import com.liferay.portal.kernel.repository.model.FileEntry;
 import com.liferay.portal.kernel.repository.model.Folder;
+import com.liferay.portal.kernel.service.WorkflowDefinitionLinkLocalServiceUtil;
+import com.liferay.portal.kernel.theme.ThemeDisplay;
 import com.liferay.portal.kernel.util.OrderByComparator;
 import com.liferay.portal.kernel.util.PortletKeys;
 
@@ -143,6 +146,17 @@ public boolean isSearch() {
 		return _search;
 	}
 
+	public boolean showDragAndDropZone(ThemeDisplay themeDisplay) {
+		if (WorkflowDefinitionLinkLocalServiceUtil.hasWorkflowDefinitionLink(
+				themeDisplay.getCompanyId(), themeDisplay.getScopeGroupId(),
+				BlogsEntry.class.getName())) {
+
+			return false;
+		}
+
+		return true;
+	}
+
 	private BlogsFileUploadsConfiguration _getBlogsFileUploadsConfiguration()
 		throws ConfigurationException {
  • modules/apps/blogs/blogs-item-selector-web/src/main/resources/META-INF/resources/blogs_attachments.jsp+1 −1 modified
    @@ -73,7 +73,7 @@ if (folder != null) {
 	portletURL="<%= blogsItemSelectorViewDisplayContext.getPortletURL(request, liferayPortletResponse) %>"
 	repositoryEntries="<%= portletFileEntries %>"
 	repositoryEntriesCount="<%= portletFileEntriesCount %>"
-	showDragAndDropZone="<%= true %>"
+	showDragAndDropZone="<%= blogsItemSelectorViewDisplayContext.showDragAndDropZone(themeDisplay) %>"
 	tabName="<%= blogsItemSelectorViewDisplayContext.getTitle(locale) %>"
 	uploadURL="<%= blogsItemSelectorViewDisplayContext.getUploadURL(liferayPortletResponse) %>"
 />

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.