VYPR
Get started
← All advisories
Low severityNVD Advisory· Published Oct 23, 2025· Updated Oct 23, 2025

CVE-2025-62255

CVE-2025-62255

Description

Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an attachment's filename.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.liferay:com.liferay.knowledge.base.webMaven
< 5.0.1095.0.109

Affected products

2

Patches

1
46dd9b77cc25

LPS-198648 escape file value before using in the input.

https://github.com/liferay/liferay-portalAmbrin ChaudharyOct 16, 2023via ghsa
commit
1 file changed · +3 −1
  • modules/apps/knowledge-base/knowledge-base-web/src/main/resources/META-INF/resources/admin/js/EditKBArticle.js+3 −1 modified
    @@ -3,6 +3,8 @@
  * SPDX-License-Identifier: LGPL-2.1-or-later OR LicenseRef-Liferay-DXP-EULA-2.0.0-2023-06
  */
 
+import {escapeHTML} from 'frontend-js-web';
+
 function attachListener(element, eventType, callback) {
 	element?.addEventListener(eventType, callback);
 
@@ -93,7 +95,7 @@ export default function EditKBArticle({kbArticle, namespace, publishAction}) {
 				`<input id="${namespace}selectedFileName${i}"
 					name="${namespace}selectedFileName"
 					type="hidden"
-					value="${filesChecked[i].value}"
+					value="${escapeHTML(filesChecked[i].value)}"
 				/>`
 			);
 		}

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.