Improper Cache Control Vulnerability in Liferay Portal and DXP Products

CVE-2025-62276

What is CVE-2025-62276?

The Improper Cache Control vulnerability in Liferay Portal and DXP exposes a security weakness by allowing local users to access downloaded files through the browser's cache. This occurs due to incorrect cache-control headers in the Document Library and Adaptive Media modules, affecting multiple versions of Liferay Portal from 7.4.0 to 7.4.3.111, as well as Liferay DXP versions 2023.Q4.0 to 2023.Q4.10 and earlier unsupported editions. Organizations using these products are at risk of unauthorized access to sensitive files, prompting a need for immediate review and mitigation steps.

References