Self Cross-site Scripting Vulnerability in Liferay Portal and DXP Products

CVE-2025-62255

What is CVE-2025-62255?

A self cross-site scripting (XSS) vulnerability has been identified in the Liferay Portal and DXP products. This vulnerability affects versions from 7.4.0 to 7.4.3.101 and older unsupported versions, as well as Liferay DXP versions 2023.Q3.1 to 2023.Q3.5. It allows remote attackers to exploit the flaw by injecting arbitrary web scripts or HTML code through a specially crafted payload in an attachment's filename on the Knowledge Base article edit page. This could potentially lead to unwanted actions executed in the context of the user’s browser, posing significant security risks.

References