Executive Summary

CVE-2025-62255 is a Self Cross-Site Scripting (Self-XSS) vulnerability in Liferay Portal and Liferay DXP. It occurs on the edit Knowledge Base article page, where an attacker can inject arbitrary web scripts or HTML by crafting a malicious payload embedded within an attachment's filename. This allows remote attackers to execute scripts in the context of the affected application. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow remote attackers to inject and execute arbitrary scripts or HTML in the context of the affected application, potentially leading to low confidentiality and integrity impacts. It requires user interaction and has a high attack complexity, meaning exploitation is not trivial. The impact does not affect availability or cause scope changes, but it could be used to manipulate or steal data accessible to the user. [1]

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should update your Liferay Portal to version 7.4.3.102 or later, or your Liferay DXP to version 2023.Q3.6, 7.3 update 35, or later. Applying these updates will fix the Self Cross-Site Scripting vulnerability related to attachment filename payload injection. [1]

Useful 0 Not Useful 0