CVE-2025-4576: Reflected XSS Vulnerability in com.liferay.blogs.web Package
Summary
CVE-2025-4576: Liferay Portal Reflected XSS in blogs-web. Affects com.liferay:com.liferay.blogs.web versions < 6.0.139. Fixed in 6.0.139. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The com.liferay.blogs.web package is a component of the Liferay Portal, which is a popular open-source platform for building web applications and managing content. This package specifically handles the blogging functionality within the portal, allowing users to create, manage, and display blog entries. The vulnerability in question affects versions of this package from 7.4.0 to 7.4.3.133 and various Liferay DXP releases, making it susceptible to reflected cross-site scripting (XSS) attacks.
Vulnerability Detail
A reflected cross-site scripting (XSS) vulnerability exists in the Liferay Portal versions 7.4.0 through 7.4.3.133 and Liferay DXP versions 2025.Q1.0 through 2025.Q1.4, among others. This vulnerability allows remote, non-authenticated attackers to inject malicious JavaScript into the application via the entry_cover_image_caption.jsp file. If exploited, this could lead to unauthorized actions being performed on behalf of users, data theft, or other malicious activities.
How To Fix
Latest published version: 6.0.144 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.0.139
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing input validation and sanitization on user inputs to mitigate the risk of XSS attacks. This can help prevent the execution of malicious scripts until the package can be updated.
Conclusion
The CVE-2025-4576 vulnerability in the com.liferay.blogs.web package poses a significant risk due to its potential for reflected XSS attacks. It is crucial for users of affected versions to update to the patched version to safeguard their applications against potential exploits.
See every vulnerability recorded for com.liferay:com.liferay.blogs.web →
FAQ
Reflected XSS vulnerabilities occur when an application includes unvalidated user input in its response, allowing attackers to inject malicious scripts that execute in the context of the user's browser.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow attackers to steal sensitive information, perform actions on behalf of users, or spread malware.
Yes, the vulnerability can be fixed by updating the com.liferay.blogs.web package to version 6.0.139 or later.
If immediate updates are not possible, implement input validation and sanitization as a temporary measure to reduce the risk of exploitation.
