VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Oct 31, 2025· Updated Nov 3, 2025

CVE-2025-62276

CVE-2025-62276

Description

The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions uses an incorrect cache-control header, which allows local users to obtain access to downloaded files via the browser's cache.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.liferay:com.liferay.adaptive.media.webMaven
< 5.0.525.0.52
com.liferay.portal:com.liferay.portal.implMaven
< 69.1.069.1.0

Affected products

2

Patches

2
9781b594cffc

LPS-174415 the adaptive media should have the same behavior with cache and download

https://github.com/liferay/liferay-portalAlicia GarcíaFeb 10, 2023via ghsa
commit
1 file changed · +12 −5
  • modules/apps/adaptive-media/adaptive-media-web/src/main/java/com/liferay/adaptive/media/web/internal/servlet/AMServlet.java+12 −5 modified
    @@ -85,16 +85,26 @@ protected void doGet(
 				throw new AMException.AMNotFound();
 			}
 
+			boolean download = ParamUtil.getBoolean(
+				httpServletRequest, "download");
+
 			long fileEntryId = _getFileEntryId(
 				String.valueOf(adaptiveMedia.getURI()));
 
 			if (fileEntryId > 0) {
+				String cacheControlValue =
+					HttpHeaders.CACHE_CONTROL_PRIVATE_VALUE;
+
+				if (download) {
+					cacheControlValue =
+						HttpHeaders.CACHE_CONTROL_NO_CACHE_VALUE;
+				}
+
 				httpServletResponse.addHeader(
 					HttpHeaders.CACHE_CONTROL,
 					FileEntryHttpHeaderCustomizerUtil.getHttpHeaderValue(
 						_dlAppLocalService.getFileEntry(fileEntryId),
-						HttpHeaders.CACHE_CONTROL,
-						HttpHeaders.CACHE_CONTROL_PRIVATE_VALUE));
+						HttpHeaders.CACHE_CONTROL, cacheControlValue));
 			}
 
 			Optional<Long> contentLengthOptional =
@@ -115,9 +125,6 @@ protected void doGet(
 
 			String fileName = fileNameOptional.orElse(null);
 
-			boolean download = ParamUtil.getBoolean(
-				httpServletRequest, "download");
-
 			if (download) {
 				ServletResponseUtil.sendFile(
 					httpServletRequest, httpServletResponse, fileName,
36c080fc4522

LPS-174415 on download the default cache value is not cache

https://github.com/liferay/liferay-portalAlicia GarcíaFeb 10, 2023via ghsa
commit
1 file changed · +9 −5
  • portal-impl/src/com/liferay/portal/webserver/WebServerServlet.java+9 −5 modified
    @@ -1176,21 +1176,25 @@ else if ((videoThumbnail > 0) && (videoThumbnail <= 3)) {
 
 		// Send file
 
+		String cacheControlValue = HttpHeaders.CACHE_CONTROL_PRIVATE_VALUE;
+
+		boolean download = ParamUtil.getBoolean(httpServletRequest, "download");
+
+		if (download) {
+			cacheControlValue = HttpHeaders.CACHE_CONTROL_NO_CACHE_VALUE;
+		}
+
 		httpServletResponse.addHeader(
 			HttpHeaders.CACHE_CONTROL,
 			FileEntryHttpHeaderCustomizerUtil.getHttpHeaderValue(
-				fileEntry, HttpHeaders.CACHE_CONTROL,
-				HttpHeaders.CACHE_CONTROL_PRIVATE_VALUE));
+				fileEntry, HttpHeaders.CACHE_CONTROL, cacheControlValue));
 
 		if (isSupportsRangeHeader(contentType)) {
 			ServletResponseUtil.sendFileWithRangeHeader(
 				httpServletRequest, httpServletResponse, fileName, inputStream,
 				contentLength, contentType);
 		}
 		else {
-			boolean download = ParamUtil.getBoolean(
-				httpServletRequest, "download");
-
 			if (download) {
 				ServletResponseUtil.sendFile(
 					httpServletRequest, httpServletResponse, fileName,

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.