CVE-2025-43830: Liferay Portal Stored XSS Vulnerability in Forms
Summary
CVE-2025-43830: Liferay Portal is vulnerable to Stored XSS through Forms text type field. Affects com.liferay.portal:release.portal.bom versions >= 7.3.2, < 7.4.3.112-ga112. Fixed in 7.4.3.112-ga112. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is a popular open-source platform for building web applications and managing content. It provides a robust framework for creating dynamic websites and applications, featuring tools for collaboration, document management, and user engagement. The platform is widely used in enterprise environments for its flexibility and scalability. However, certain versions of Liferay Portal are vulnerable to a stored cross-site scripting (XSS) issue, which can be exploited by attackers to inject malicious scripts into web pages.
Vulnerability Detail
The stored cross-site scripting (XSS) vulnerability affects Liferay Portal versions 7.3.2 through 7.4.3.111, as well as Liferay DXP versions 2023.Q4.0 through 2023.Q4.5 and 2023.Q3.1 through 2023.Q3.8. This vulnerability allows remote attackers to inject arbitrary web scripts or HTML into forms with rich text type fields. The origin of this issue lies in insufficient input validation, which permits crafted payloads to be stored and executed in the context of other users' sessions, potentially leading to data theft, session hijacking, or other malicious activities.
How To Fix
Latest published version: 7.4.3.132 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.4.3.112-ga112
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to disable the rich text editor for forms until the patch can be applied. This can be done by modifying the form configuration settings in the Liferay Portal administration panel.
Conclusion
The stored XSS vulnerability in Liferay Portal poses a significant risk to users and applications utilizing affected versions. It is crucial to apply the recommended patch to mitigate this risk effectively. Users should also consider using tools like Vulert for ongoing monitoring of vulnerabilities in their software.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
Stored XSS is a type of security vulnerability where an attacker can inject malicious scripts into a web application, which are then stored on the server and executed in the browser of users who access the affected page.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to analyze your pom.xml without any signup.
The risks include unauthorized access to user data, session hijacking, and the potential for attackers to perform actions on behalf of users, leading to data breaches or other malicious activities.
Yes, disabling the rich text editor for forms can help mitigate the risk until the patch is applied.
If immediate updates are not possible, ensure that users are aware of the risk and monitor for any suspicious activity while implementing the temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
