CVE-2025-62255: Self Cross-site Scripting (XSS) Vulnerability in com.liferay.knowledge.base.web Package
Summary
CVE-2025-62255: Liferay Portal Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page. Affects com.liferay:com.liferay.knowledge.base.web versions < 5.0.109. Fixed in 5.0.109. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The com.liferay.knowledge.base.web package is part of the Liferay Portal, a popular open-source platform for building web applications and managing content. This package specifically handles the Knowledge Base functionality, allowing users to create, edit, and manage articles. The vulnerability in question affects versions of this package from 7.4.0 to 7.4.3.101, as well as older unsupported versions, making it crucial for users to be aware of potential security risks.
Vulnerability Detail
The vulnerability is a Self Cross-site Scripting (XSS) issue that occurs on the edit Knowledge Base article page. It allows remote attackers to inject arbitrary web scripts or HTML into the application via a crafted payload in an attachment's filename. This can lead to unauthorized actions being performed on behalf of the user, potentially compromising sensitive information and the integrity of the application.
How To Fix
Minimum fixed version
5.0.109
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can sanitize attachment filenames to prevent the injection of malicious scripts. This can be done by implementing a validation check that restricts special characters in filenames before they are processed by the application.
Conclusion
The CVE-2025-62255 vulnerability presents a significant risk to users of the com.liferay.knowledge.base.web package. It is essential for users to update to the patched version to mitigate potential security threats. Additionally, implementing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for com.liferay:com.liferay.knowledge.base.web →
FAQ
CVE-2025-62255 is a vulnerability in the com.liferay.knowledge.base.web package that allows for Self Cross-site Scripting (XSS) attacks.
The vulnerability affects Liferay Portal versions 7.4.0 through 7.4.3.101 and older unsupported versions, as well as Liferay DXP 2023.Q3.1 through 2023.Q3.5.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply checking your pom.xml file on the Vulert playground, you can determine if your application is affected by this vulnerability.
The risks include unauthorized access to user accounts, data theft, and the potential for attackers to execute malicious scripts within the application.
Yes, a patch is available in version 5.0.109 of the com.liferay.knowledge.base.web package. Users are advised to update to this version or later.
