CVE-2025-62255: 
Java vulnerability analysis and mitigation

CVE-2025-62255 is a Self Cross-Site Scripting (Self-XSS) vulnerability affecting the edit Knowledge Base article page in Liferay Portal and Liferay DXP. It allows remote attackers to inject arbitrary web script or HTML via a crafted payload embedded in an attachment's filename. Affected versions include Liferay Portal 7.4.0 through 7.4.3.101 (and older unsupported versions), and Liferay DXP 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 (and older unsupported versions). The vulnerability was published on October 23, 2025, with a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 2.0 (Low) (GitHub Advisory, Liferay Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), rooted in insufficient sanitization of user-supplied input in the Knowledge Base article attachment filename field (GitHub Advisory). An attacker with low-privilege access can craft a malicious filename containing JavaScript or HTML payloads, which are then rendered unsanitized when the edit Knowledge Base article page is loaded. Exploitation requires user interaction (the victim must actively view the affected page) and low privileges, making this a Self-XSS variant where the injected script executes in the context of the user who uploaded the malicious filename. The affected Maven package is com.liferay:com.liferay.knowledge.base.web, with versions below 5.0.109 being vulnerable (GitHub Advisory).

Successful exploitation can result in limited confidentiality and integrity impacts within the vulnerable system, including potential session hijacking, theft of user credentials, manipulation of page content, and unauthorized actions performed on behalf of the victim (GitHub Advisory). Because this is a Self-XSS vulnerability, the scope is primarily limited to the attacker's own session or scenarios where social engineering is used to trick another user into triggering the payload. There is no availability impact and no impact on subsequent systems, limiting the overall severity (Liferay Advisory).

1. Obtain low-privilege access: Log in to a vulnerable Liferay Portal or DXP instance (versions 7.4.0–7.4.3.101 or DXP 2023.Q3.1–2023.Q3.5 / 7.4 GA–update 92) with any authenticated user account.
2. Navigate to Knowledge Base: Access the Knowledge Base module and open or create an article for editing.
3. Attach a file with a malicious filename: Upload an attachment to the Knowledge Base article, naming the file with an XSS payload (e.g., <img src=x onerror=alert(document.cookie)>.txt or similar HTML/JavaScript injection).
4. Trigger the payload: Navigate to the edit page of the Knowledge Base article containing the malicious attachment. The unsanitized filename is rendered in the page, causing the injected script to execute in the browser context.
5. Achieve objective: The executed script can steal session cookies, perform actions on behalf of the victim, or manipulate page content. Social engineering may be required to have a higher-privileged user visit the affected edit page to escalate impact (GitHub Advisory, Liferay Advisory).

• Logs: Web server or application access logs showing requests to Knowledge Base article edit pages with unusual or encoded characters in attachment filename parameters (e.g., <, >, script, onerror, javascript: in filenames).
• File System: Presence of uploaded attachments in the Liferay document library with filenames containing HTML tags or JavaScript syntax (e.g., filenames with <script>, onerror=, or alert().
• Network: Unexpected outbound requests from the Liferay server or client browsers to unknown external domains following interaction with Knowledge Base article edit pages, potentially indicating data exfiltration via injected scripts.
• Application Behavior: Unexpected JavaScript alerts, redirects, or anomalous browser behavior when editing Knowledge Base articles containing attachments.

Liferay has released a patch addressing this vulnerability: upgrade the com.liferay:com.liferay.knowledge.base.web Maven package to version 5.0.109 or later (GitHub Advisory). For Liferay Portal, upgrade to version 7.4.3.102 or later; for Liferay DXP, upgrade beyond 2023.Q3.5 or beyond update 92 for the 7.4 line (Liferay Advisory). As interim mitigations, implement strict input validation and output encoding for attachment filenames, enforce Content Security Policy (CSP) headers, and limit user privileges to reduce the attack surface.