CVE-2025-43791: Liferay DXP Rich Text Field XSS Vulnerability

CVE-2025-43791 Overview

CVE-2025-43791 covers multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal and Liferay Digital Experience Platform (DXP). The flaws affect Liferay Portal versions 7.3.0 through 7.4.3.111 and DXP releases 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 36. Authenticated remote attackers can inject arbitrary HTML or JavaScript through crafted payloads sent to Rich Text type fields used by web content structures, Documents and Media Document Types, and custom assets built on the Data Engine module. The issue is tracked under CWE-79.

Critical Impact
Stored XSS payloads execute in the browser of any user who views the affected content, enabling session theft, account takeover, and defacement of Liferay-hosted portals.

Affected Products

Liferay Portal 7.3.0 through 7.4.3.111
Liferay DXP 7.4 GA through update 92, and 7.3 GA through update 36
Liferay DXP 2023.Q4.0 and 2023.Q3.1 through 2023.Q3.4

Discovery Timeline

2025-09-15 - CVE-2025-43791 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43791

Vulnerability Analysis

The advisory documents multiple stored XSS sinks that share a common root: the Rich Text field type provided by the Liferay Data Engine module. When authors submit content through a web content structure, a Documents and Media Document Type, or any custom asset that reuses the Data Engine Rich Text field, the payload is persisted without sufficient output encoding. When the content is later rendered, the injected script executes in the context of the Liferay portal origin.

Because the attack requires only low-privileged authoring rights and a victim who views the injected content, any multi-tenant or community-facing Liferay deployment inherits the risk. Successful exploitation yields the same origin privileges as the viewing user, which can include session cookies, CSRF tokens, and portlet APIs. Administrators who review pending content are particularly attractive victims for privilege escalation.

Root Cause

The underlying weakness is improper neutralization of input during web page generation ([CWE-79]) in the Rich Text field rendering pipeline. The Data Engine module trusts markup submitted by authenticated users and forwards it to downstream renderers that treat it as safe HTML, bypassing Liferay's normal sanitization for structured content.

Attack Vector

An authenticated user with content creation permissions crafts HTML or JavaScript inside a Rich Text field on a web content structure, a Documents and Media Document Type, or a custom Data Engine asset. Liferay stores the raw markup and later injects it into pages served to other authenticated users or, depending on portal configuration, to unauthenticated visitors. No user interaction beyond viewing the affected page is required for the payload to execute.

No public proof-of-concept exploit was referenced in the advisory. Refer to the Liferay Security Advisory CVE-2025-43791 for vendor technical details.

Detection Methods for CVE-2025-43791

Indicators of Compromise

Stored web content, document type metadata, or Data Engine records containing <script>, onerror=, onload=, javascript: URIs, or encoded variants inside Rich Text fields.
Unexpected outbound requests from Liferay users' browsers to attacker-controlled domains shortly after loading a portal page hosting user-generated content.
Sudden creation or edit events on web content structures and Document Types by low-privileged authoring accounts.

Detection Strategies

Query the Liferay database (JournalArticle, DDMContent, DLFileEntryMetadata) for stored markup containing script tags or DOM event handler attributes.
Enable Liferay audit logging for content creation and modification events, then alert on Rich Text submissions containing HTML control characters from non-administrator accounts.
Deploy a web application firewall rule set that inspects POST bodies to Liferay's content APIs for XSS signatures, including base64 and HTML-entity encoded payloads.

Monitoring Recommendations

Forward Liferay application logs, WAF logs, and reverse proxy access logs to a centralized analytics platform and baseline normal authoring activity.
Monitor Content Security Policy (CSP) violation reports from browsers to surface script executions that deviate from the portal's approved sources.
Review new or modified custom assets weekly for any that embed Data Engine Rich Text fields, since these expand the attack surface for CVE-2025-43791.

How to Mitigate CVE-2025-43791

Immediate Actions Required

Upgrade Liferay Portal to a fixed release beyond 7.4.3.111 and apply the corresponding DXP updates as listed in the vendor advisory.
Restrict content authoring, Document Type management, and Data Engine asset creation privileges to trusted roles only.
Audit existing Rich Text content for injected scripts and sanitize or delete any suspicious entries before patching.

Patch Information

Liferay has published fixed builds and remediation guidance in the Liferay Security Advisory CVE-2025-43791. Administrators running self-hosted DXP should follow the standard update procedure for their branch (7.3.x, 7.4.x, or the quarterly 2023.Q3/Q4 releases). Liferay SaaS tenants receive the fix through the managed update pipeline.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins to limit payload execution.
Configure Liferay's HTML sanitizer (com.liferay.portal.security.xss) and role-based permissions to prevent low-trust users from submitting raw HTML.
Place a web application firewall in front of the portal with signatures for stored XSS payloads targeting /o/headless-delivery/, /api/jsonws/, and web content endpoints.

bash

# Example nginx WAF-style filter to block obvious XSS payloads to Liferay content APIs
location ~* ^/(o/headless-delivery|api/jsonws|group/[^/]+/~/control_panel) {
    if ($request_body ~* "(<script|javascript:|onerror=|onload=)") {
        return 403;
    }
    proxy_pass http://liferay_upstream;
}