Liferay Portal CVE-2025-62255

Requires an authenticated user (PR:L) with permission to create or edit a Knowledge Base article and upload attachments, who must inject a crafted payload into an attachment's filename. Because it is SELF-XSS, the script executes only in the injecting user's own browser context - there is no cross-user execution path, so exploitation additionally requires social-engineering the victim into supplying the malicious filename themselves (reflected in UI:A and AC:H). Limiting factors: authentication requirement, active user interaction, and the self-contained (same-session) execution scope sharply reduce realistic impact.

This is a low-priority issue despite being network-reachable. The CVSS 4.0 vector (AV:N/AC:H/PR:L/UI:A, VC:L/VI:L) yields a base score of only 2.0, and every independent signal corroborates low real-world risk: EPSS is 0.21% (11th percentile), there is no CISA KEV listing, and no public exploit code was identified. Critically, this is explicitly a SELF cross-site script - the payload is injected into an attachment filename and executes only in the context of the user who performed the injection, so it does not cross user/trust boundaries without the victim being socially engineered into injecting the payload against themselves. The high attack complexity (AC:H) and required active user interaction (UI:A) in the vector reflect this self-XSS nature. The signals are consistent, not conflicting: low EPSS, no KEV, no POC, and a self-XSS classification all point the same direction. The main caveat is a data discrepancy on affected versions (see confidence_notes), which does not change the risk tier.

An authenticated Liferay user editing a Knowledge Base article uploads an attachment whose filename contains a crafted HTML/script payload; when the edit page renders that filename, the script executes in that same user's browser. Because it is self-XSS, a realistic attack requires an adversary to socially-engineer the victim into pasting the malicious filename themselves, limiting impact to the user's own session. No public exploit code was identified at time of analysis.