Back to feed
EUVD-2025-35729 · Published Oct 23, 2025
Liferay Portal Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an attachment's filename.
Technologies
Liferay Liferay PortalLiferay Digital Experience Platform
Weaknesses
CWE-79
References
- https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62255
- https://nvd.nist.gov/vuln/detail/CVE-2025-62255
- https://github.com/liferay/liferay-portal/commit/46dd9b77cc2514761828d9b483a1dfe5d6e6b76d
- https://github.com/liferay/liferay-portal
- https://liferay.atlassian.net/browse/LPE-17842
Potentially impacted assets
See if this affects your attack surface
