2025-10-23

CVE-2025-62255 Oct 23, 19:15 LOW PATCH Monitor

Self-cross-site scripting in Liferay Portal and Liferay DXP lets an authenticated Knowledge Base editor store a crafted script or HTML payload in an attachment filename, which then executes in that same user's browser when the article edit page renders the filename. Affected releases are Liferay Portal 7.4.0 through 7.4.3.101, Liferay DXP 2023.Q3.1 through 2023.Q3.5 and 7.4 GA through update 92, and older unsupported versions; the CVSS 4.0 score is 2.0 and the assessed CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N. No public exploit has been identified at time of analysis, CISA KEV does not list this CVE, and EPSS is 0.21% (11th percentile), consistent with a low-priority, self-contained XSS requiring authentication and user interaction.