CVE-2025-62265: Liferay Portal Blogs Widget XSS Vulnerability
Summary
CVE-2025-62265: Liferay Portal is vulnerable to XSS in the Blogs widget. Affects com.liferay.portal:release.portal.bom versions >= 7.4.0-ga1, < 7.4.3.112-ga112. Fixed in 7.4.3.112-ga112. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is a popular open-source platform for building web applications and websites. It provides a robust set of features including content management, collaboration tools, and social networking capabilities. The Blogs widget allows users to create and manage blog entries easily. However, certain versions of this widget are vulnerable to cross-site scripting (XSS) attacks, which can compromise the security of the application and its users.
Vulnerability Detail
The vulnerability arises from the Blogs widget in Liferay Portal versions 7.4.0 through 7.4.3.111 and older unsupported versions, as well as Liferay DXP versions 2023.Q4.0 through 2023.Q4.10 and 2023.Q3.1 through 2023.Q3.8. The issue is due to the absence of the sandbox attribute on <iframe> elements, allowing attackers to inject arbitrary web scripts or HTML into a blog entry's 'Content' text field. This can lead to unauthorized access to the parent page, potentially allowing attackers to execute malicious scripts and steal sensitive information.
How To Fix
Latest published version: 7.4.3.132 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.4.3.112-ga112
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can sanitize user input in the 'Content' text field to prevent the injection of malicious scripts. This can be done by implementing input validation and escaping special characters before rendering the content on the page.
Conclusion
The XSS vulnerability in the Blogs widget of Liferay Portal poses a significant risk to users and applications. It is crucial to update to the latest patched version to safeguard against potential attacks. Additionally, implementing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
The CVSS score of this vulnerability is 4.8, indicating a moderate severity level.
The affected versions include Liferay Portal 7.4.0 through 7.4.3.111, older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, among others.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Cross-site scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially compromising their data and security.
If immediate updating is not possible, implement input validation and sanitization as a temporary workaround to mitigate the risk of XSS attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
