CVE-2025-62255

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.0 through 7.4.3.101 Liferay DXP versions 2023.Q3.1 through 2023.Q3.5 Liferay Portal versions 7.4 GA through update 92

Description A self cross-site scripting (XSS) issue exists on the edit Knowledge Base article page. This allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an attachment's filename.

Recommendations Update Liferay Portal to a version later than 7.4.3.101. Update Liferay DXP to a version later than 2023.Q3.5. Update Liferay Portal to a version later than update 92.