CVE-2025-62240: XSS Vulnerability in com.liferay.calendar.web Package
Summary
CVE-2025-62240: Liferay Portal is vulnerable to XSS through its Calendar Events parameters. Affects com.liferay:com.liferay.calendar.web versions >= 5.0.45, < 5.0.88. Fixed in 5.0.88. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The com.liferay.calendar.web package is a component of the Liferay Portal, which is a popular open-source platform for building web applications and managing content. This package specifically handles calendar functionalities, allowing users to create and manage events. However, it has been found to be vulnerable to multiple cross-site scripting (XSS) attacks, which can compromise the security of applications built on this platform.
Vulnerability Detail
The vulnerability arises from improper handling of user input in the Calendar events feature of Liferay Portal versions 7.4.3.35 to 7.4.3.111 and Liferay DXP versions 2023.Q4.0 to 2023.Q4.5, among others. Attackers can exploit this vulnerability by injecting malicious scripts through user fields such as First Name, Middle Name, or Last Name. If successful, this could lead to unauthorized actions being performed on behalf of the user, data theft, or session hijacking.
How To Fix
Latest published version: 5.0.110 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.0.88
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider sanitizing user inputs to prevent XSS attacks. This can be done by implementing input validation and encoding output before rendering it in the browser. For example, you can use libraries like OWASP Java Encoder to encode user inputs before displaying them.
Conclusion
The CVE-2025-62240 vulnerability in the com.liferay.calendar.web package poses a significant risk due to its potential for XSS attacks. It is crucial for users of affected Liferay versions to apply the necessary updates or implement workarounds to safeguard their applications.
See every vulnerability recorded for com.liferay:com.liferay.calendar.web →
FAQ
CVE-2025-62240 is a vulnerability identifier for a cross-site scripting (XSS) issue found in the com.liferay.calendar.web package of Liferay Portal.
The affected versions include Liferay Portal 7.4.3.35 through 7.4.3.111 and Liferay DXP 2023.Q4.0 through 2023.Q4.5, among others.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply uploading your pom.xml file to the Vulert playground, you can check for vulnerabilities without any signup.
If exploited, this vulnerability can allow attackers to execute arbitrary scripts in the context of the user's session, leading to data theft, unauthorized actions, or session hijacking.
Yes, the permanent fix is to update the com.liferay.calendar.web package to version 5.0.88 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay:com.liferay.calendar.web.
