CVE-2025-43778: Liferay DXP Stored XSS Vulnerability

CVE-2025-43778 Overview

CVE-2025-43778 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw resides in the Kaleo Forms Admin component, where the name field of a fieldset is not properly sanitized or escaped before rendering. A remote authenticated attacker can inject JavaScript that is persistently stored and executed in the browser of any user who views the affected form. The issue was published to the National Vulnerability Database on 2025-09-09 and last updated on 2026-06-17.

Critical Impact

An authenticated attacker with permission to manage Kaleo Forms can persist JavaScript that runs in other users' sessions, enabling session theft, UI redress, and unauthorized actions in the portal.

Affected Products

• Liferay Portal 7.4.0 through 7.4.3.132
• Liferay DXP 2025.Q2.0 through 2025.Q2.11, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7
• Liferay DXP 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, and 2024.Q1.1 through 2024.Q1.20

Discovery Timeline

• 2025-09-09 - CVE-2025-43778 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43778

Vulnerability Analysis

The vulnerability is a stored (persistent) XSS in the Kaleo Forms Admin interface of Liferay Portal and DXP. When an authenticated administrator creates or edits a form, the name attribute of a fieldset accepts arbitrary input. The application stores the value and later renders it into an HTML context without adequate output encoding. Any user who subsequently loads the form triggers execution of the attacker-supplied JavaScript in the context of the Liferay origin.

Exploitation requires high privileges in the current implementation because Kaleo Forms Admin is a restricted workflow-forms feature. However, once the payload is stored, victims include lower-privileged users and other administrators, enabling lateral privilege abuse within the portal. The EPSS score is 0.226%, indicating low near-term exploitation probability, but persistent XSS in an administrative console remains a durable foothold.

Root Cause

The root cause is missing or incomplete output encoding on the fieldset name property in the Kaleo Forms rendering path. Input validation on the write side and contextual HTML escaping on the render side are both insufficient, allowing <script> tags and event-handler attributes to survive into the DOM.

Attack Vector

The attack requires network access to the Liferay web interface and authenticated access with rights to manage Kaleo Forms. The attacker submits a fieldset whose name contains a JavaScript payload. Victims trigger execution passively by navigating to any view that renders the affected fieldset name. User interaction is required on the victim side, consistent with typical stored XSS delivery.

No verified public exploit code is available. Refer to the Liferay Security Advisory CVE-2025-43778 for authoritative technical details.

Detection Methods for CVE-2025-43778

Indicators of Compromise

• Kaleo Forms fieldset names containing HTML tags, <script> blocks, javascript: URIs, or event-handler attributes such as onerror, onload, or onmouseover.
• Unexpected outbound requests from authenticated browser sessions to attacker-controlled domains shortly after loading a Kaleo Forms page.
• Portal audit records showing form or fieldset edits by accounts that do not normally administer Kaleo workflows.

Detection Strategies

• Query the Liferay database or export forms metadata and grep fieldset name values for angle brackets, on*= handlers, and script schemes.
• Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution originating from portal pages.
• Correlate Liferay access logs with browser DOM-based XSS telemetry from web application firewall (WAF) or RASP agents on the portal tier.

Monitoring Recommendations

• Enable Liferay audit logging for form and workflow object mutations and forward the events to a centralized SIEM.
• Monitor administrator account activity for anomalous form-editing behavior, particularly from new IPs or off-hours sessions.
• Alert on responses from Kaleo Forms endpoints containing suspicious script fragments to catch payload storage in near real time.

How to Mitigate CVE-2025-43778

Immediate Actions Required

• Apply the fixed releases published by Liferay for Portal 7.4 and DXP 2024.Q1 through 2025.Q2 as documented in the vendor advisory.
• Audit existing Kaleo forms for fieldset names containing HTML or JavaScript payloads and remove or sanitize offending entries.
• Restrict Kaleo Forms Admin permissions to the minimum set of trusted administrators required for business operations.

Patch Information

Liferay has published fixed builds for the affected Portal 7.4 and DXP quarterly release lines. Consult the Liferay Security Advisory CVE-2025-43778 for the exact patched versions and hotfix identifiers applicable to your deployment channel.

Workarounds

• Remove or narrow the Kaleo Forms Admin role assignments until patches are applied.
• Enforce a strict Content Security Policy that disallows inline scripts on portal pages to blunt payload execution.
• Place the Liferay portal behind a WAF with rules that block angle brackets and event-handler patterns in form-definition payloads.

# Example CSP header to restrict inline script execution on Liferay pages
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'";