Liferay Commerce CVE-2025-43829

Requires an authenticated account (PR:L) with permission to create or edit diagram-type products within the Liferay Commerce module, and the ability to upload/inject a crafted SVG file carrying a script payload. Exploitation further requires active user interaction (UI:A) - a victim must view the affected diagram/product for the stored script to fire. Limiting factors: the Commerce module and its diagram-type product feature must be deployed and in use; the attacker cannot be fully unauthenticated; and impact is confined to the victim's browser context (no availability impact, limited confidentiality/integrity). This narrows realistic risk to environments where many lower-trust users can author Commerce diagram content.

This is a genuinely medium/low-priority issue, not a high-urgency one. The CVSS 4.0 score of 4.8 (Medium) is consistent across all signals: the vector AV:N/AC:L/PR:L/UI:A shows a stored XSS that requires an authenticated attacker (PR:L) with access to the Commerce diagram-type feature plus active victim interaction (UI:A), and impact is limited (VC:L/VI:L/VA:N). EPSS reinforces low real-world risk at 0.22% (12th percentile). There is no CISA KEV listing and no public exploit identified at time of analysis, so there is no public evidence of active exploitation. No SSVC decision data was provided. All signals align - low exploitation probability, no exploitation evidence, bounded impact - so this does not warrant emergency patching but should be remediated in normal cycles, prioritized for internet-facing Liferay Commerce deployments where many lower-privileged users can author diagram content. One data discrepancy: the CPE list enumerates Liferay DXP 7.3 builds, while the description states affected versions are Portal 7.4.3.18-7.4.3.111 and DXP 2023.Q4/2023.Q3/7.4 update 18-92 - verify the exact affected build set against the vendor advisory before scoping.

A low-privileged but authenticated Liferay Commerce user uploads or edits a diagram-type product and embeds a crafted SVG file containing a malicious script payload. When another user - potentially an administrator or customer - later views that diagram/product page, the stored script executes in their browser session, enabling session-context actions such as cookie theft or UI redressing. No public exploit code is identified, so an attacker would need to craft the SVG payload themselves.