CVE-2025-43825: Liferay Portal Freemarker Template Vulnerability Exposes Sensitive User Data
Summary
CVE-2025-43825: Liferay Portal exposes sensitive user data through its Freemarker template. Affects com.liferay:com.liferay.portal.template.freemarker versions >= 7.0.3, < 7.0.60. Fixed in 7.0.60. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is a popular open-source platform designed for building web applications and managing content. It provides a robust framework for developers to create dynamic websites and applications, leveraging features such as user management, content management, and templating systems. The Freemarker template engine is utilized within Liferay to render dynamic content. However, certain versions of Liferay Portal and Liferay DXP have a vulnerability that allows sensitive user data to be unintentionally included in Freemarker templates, posing a risk to user privacy and data security.
Vulnerability Detail
The vulnerability arises from improper handling of sensitive user data within Freemarker templates in Liferay Portal versions 7.4.0 through 7.4.3.132 and various Liferay DXP releases. This flaw allows unauthorized actors to access and potentially render confidential information that should remain restricted. The risk is particularly significant as it could lead to data breaches, exposing sensitive user information to malicious entities.
How To Fix
Minimum fixed version
7.0.60
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to review and sanitize the data being passed to Freemarker templates to ensure that sensitive information is not inadvertently exposed. Implementing strict access controls and data validation can help mitigate the risk until the package is updated.
Conclusion
The CVE-2025-43825 vulnerability in Liferay Portal exposes sensitive user data through its Freemarker template system, posing a significant risk to user privacy. It is crucial for users to update to the patched version 7.0.60 or later to mitigate this risk. Implementing workarounds and monitoring tools like Vulert can further enhance security.
See every vulnerability recorded for com.liferay:com.liferay.portal.template.freemarker →
FAQ
The vulnerability affects Liferay Portal versions 7.4.0 through 7.4.3.132 and various Liferay DXP releases.
Sensitive user data, including personal information and confidential details, may be exposed due to this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, review and sanitize the data passed to Freemarker templates and implement strict access controls as a temporary measure.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the pom.xml file.
