Low severityGHSA Advisory· Published Sep 9, 2025· Updated Sep 18, 2025
CVE-2025-43774
CVE-2025-43774
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
com.liferay:com.liferay.frontend.taglib.clayMaven | < 15.2.1 | 15.2.1 |
Affected products
1- Range: < 15.2.1
Patches
1e15df92e3faaLPD-52924 - getSubtitle should be escaped since it is already being escaped in the React component, but just not on the first load.
1 file changed · +1 −1
modules/apps/frontend-taglib/frontend-taglib-clay/src/main/java/com/liferay/frontend/taglib/clay/servlet/taglib/VerticalCardTag.java+1 −1 modified@@ -625,7 +625,7 @@ else if (Validator.isNotNull(stickerLabel)) { jspWriter.write("<p class=\"card-subtitle\"><span class=\""); jspWriter.write("text-truncate-inline\"><span class=\""); jspWriter.write("text-truncate\">"); - jspWriter.write(subtitle); + jspWriter.write(HtmlUtil.escape(subtitle)); jspWriter.write("</span></span></p>"); }
Vulnerability mechanics
Not enough inputs (no patches or CWE) to synthesize mechanics for this CVE.
References
5- github.com/advisories/GHSA-qgj5-4qvg-2f8cghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-43774ghsaADVISORY
- github.com/liferay/liferay-portal/commit/e15df92e3faa3abbf38e3643b79ab8cf2983d6dfghsaWEB
- liferay.atlassian.net/browse/LPE-18222ghsaWEB
- liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43774ghsaWEB
News mentions
0No linked articles in our index yet.