CVE-2025-43824: Liferay Portal Profile Widget vCard Extension Spoofing Vulnerability
Summary
CVE-2025-43824: Liferay Profile Widget does not prevent vCard extension spoofing. Affects com.liferay.portal:release.portal.bom versions >= 7.4.0-ga1, < 7.4.3.112-ga112. Fixed in 7.4.3.112-ga112. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Liferay Portal is a popular open-source platform for building web applications and managing content. The Profile widget allows users to manage their profiles and download vCard files. This functionality is crucial for users who want to share their contact information easily. However, certain versions of Liferay Portal have a vulnerability that can be exploited to change the file extension of downloaded vCard files, potentially leading to security risks.
Vulnerability Detail
The vulnerability arises from the Profile widget in Liferay Portal versions 7.4.0 through 7.4.3.111 and older unsupported versions, as well as Liferay DXP versions 2023.Q4.0 through 2023.Q4.5 and 2023.Q3.1 through 2023.Q3.8. It uses a user's name in the 'Content-Disposition' header when downloading vCard files. This allows remote authenticated users to manipulate the file extension, which could lead to users inadvertently executing malicious files instead of legitimate vCard files. The issue is classified under CWE-79, indicating a potential for cross-site scripting or similar attacks.
How To Fix
Latest published version: 7.4.3.132 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.4.3.112-ga112
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that users are aware of the potential risks when downloading vCard files from the Profile widget. Educate users to verify file extensions before opening downloaded files.
Conclusion
In summary, CVE-2025-43824 is a moderate severity vulnerability in Liferay Portal that can lead to vCard extension spoofing. It is crucial for users to update to the patched version to mitigate risks. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
CVE-2025-43824 is a vulnerability in Liferay Portal that allows remote authenticated users to change the file extension of downloaded vCard files, potentially leading to security risks.
The vulnerability affects Liferay Portal versions 7.4.0 through 7.4.3.111 and older unsupported versions, as well as certain versions of Liferay DXP.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If immediate updates are not possible, educate users about the risks associated with downloading vCard files and encourage them to verify file extensions before opening.
Vulert is a tool that monitors open-source vulnerabilities in software using just the pom.xml file. It provides real-time alerts and insights without requiring access to the code.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
