CVE-2025-62255

published 2025-10-23

CVE-2025-62255: Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older unsupported…

low 2 CVSS 4.0

AV N AC H AT N PR L UI A VC L VI L VA N SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an attachment's filename.

Affected

13 ranges

Vendor	Product	Version range	Fixed in
liferay	digital_experience_platform	< 7.3	7.3
liferay	digital_experience_platform	—	—
liferay	digital_experience_platform	—	—
liferay	digital_experience_platform	—	—
liferay	digital_experience_platform	—	—
liferay	digital_experience_platform	—	—
liferay	digital_experience_platform	—	—
liferay	digital_experience_platform	—	—
liferay	dxp	2023.Q3.1 – 2023.Q3.5	—
liferay	dxp	7.3.10 – 7.3.10-u34	—
liferay	dxp	7.4.13 – 7.4.13-u92	—
liferay	liferay_portal	< 7.4.3.102	7.4.3.102
liferay	portal	7.4.0 – 7.4.3.101	—

CWE-79