CVE-2025-43733: Liferay Layout Taglib Vulnerable to Reflected Cross-Site Scripting
Summary
CVE-2025-43733: Liferay Portal Vulnerable to Cross-Site Scripting. Affects com.liferay:com.liferay.layout.taglib versions < 17.0.0. Fixed in 17.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay is a popular open-source platform for building digital experiences. The 'com.liferay.layout.taglib' package is part of Liferay's tag library, which provides various functionalities for managing layouts in web applications. This package is widely used in Liferay Portal and Liferay DXP, making it crucial for developers to ensure its security and integrity.
Vulnerability Detail
A reflected cross-site scripting (XSS) vulnerability exists in Liferay Portal versions 7.4.3.132 and Liferay DXP versions 2025.Q1.0 through 2025.Q1.7. This vulnerability allows a remote authenticated attacker to inject malicious JavaScript code via the content page's name field. When users view the 'document View Usages' page, this injected code is executed in their browsers, potentially leading to unauthorized actions or data theft.
How To Fix
Minimum fixed version
17.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that user input is properly sanitized and validated before being reflected in the application. This can help mitigate the risk of XSS attacks until the package is updated.
Conclusion
The CVE-2025-43733 vulnerability in the Liferay layout tag library poses a significant security risk due to its potential for reflected cross-site scripting attacks. It is essential for users of affected versions to update to the patched version to mitigate this risk.
See every vulnerability recorded for com.liferay:com.liferay.layout.taglib →
FAQ
CVE-2025-43733 is a vulnerability identifier for a reflected cross-site scripting issue found in specific versions of Liferay's layout tag library.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can use the Vulert playground at Vulert Scanner without signing up.
If exploited, this vulnerability can allow attackers to execute arbitrary JavaScript in the context of a user's browser, potentially leading to data theft or unauthorized actions.
Update the 'com.liferay.layout.taglib' package to version 17.0.0 or later by modifying your pom.xml file as shown in the 'how_to_fix' section.
A reflected XSS vulnerability occurs when an attacker is able to inject malicious scripts into a web application, which are then reflected back to users without proper validation or sanitization.
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay:com.liferay.layout.taglib.
