Liferay Portal CVE-2025-43824

Exploitation requires a valid authenticated account on the Liferay instance (PR:L) with the ability to set the user's own name/profile field, plus active user interaction (UI:A): a victim must actually download the Profile widget's vCard file for the malformed Content-Disposition header to take effect. The specific required feature is the Profile widget's vCard download function, which reflects the user-controlled name into the Content-Disposition header. Limiting factors: no code execution or data disclosure results, impact is confined to altering the downloaded file's extension, and the attack fails without the victim's download action - substantially narrowing real-world risk below what the CWE-79 label alone might imply.

This is a genuinely low-priority issue despite being network-reachable. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N) scores 4.8 (medium) and the signals are internally consistent: it requires authentication (PR:L) and active user interaction (UI:A - a victim must download the vCard), delivers no confidentiality or availability impact, and only a LOW integrity impact (VI:L). The CWE-79 classification and 'XSS' tag suggest a cross-site-scripting angle, but the description itself describes only file-extension manipulation in the Content-Disposition header when a vCard is downloaded - the realistic impact is misleading a victim into saving a file under an unexpected/attacker-influenced extension rather than script execution in the victim's browser, so treat the XSS label as the vendor's category hint rather than confirmed reflected-script execution. EPSS is low (0.23%, 13th percentile) and there is no KEV listing and no identified public exploit, all of which align with the low CVSS - there is no conflict among the signals. Bottom line: a low-severity, authenticated, interaction-dependent integrity flaw, not an urgent remediation item.

An authenticated Liferay user sets a crafted display name that embeds a filename/extension payload; when another user (or the attacker-targeted victim) downloads that profile's vCard, the Content-Disposition header derived from the name causes the file to be saved with a changed extension. No public exploit code was identified, and successful abuse requires the victim to actively perform the download.