CVE-2025-43818 Overview
CVE-2025-43818 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in the Calendar widget of Liferay Portal and Liferay Digital Experience Platform (DXP). An authenticated attacker can inject arbitrary HTML or JavaScript through the Calendar's Name text field. When another user renders the affected Calendar, the injected script executes in that user's browser session under the origin of the Liferay application.
The issue affects Liferay Portal versions 7.4.3.35 through 7.4.3.110 and multiple Liferay DXP release trains, including 2023.Q4 and 2023.Q3 quarterly releases, plus 7.4 and 7.3 update branches.
Critical Impact
Successful exploitation enables session hijacking, credential theft through crafted forms, and unauthorized actions performed in the context of the victim user, including portal administrators.
Affected Products
- Liferay Portal 7.4.3.35 through 7.4.3.110
- Liferay DXP 2023.Q4.0 through 2023.Q4.4 and 2023.Q3.1 through 2023.Q3.6
- Liferay DXP 7.4 update 35 through update 92 and 7.3 update 25 through update 36
Discovery Timeline
- 2025-09-29 - CVE-2025-43818 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-43818
Vulnerability Analysis
The Calendar widget in Liferay Portal accepts user-supplied input in the Name field without applying adequate output encoding or input sanitization. The stored value is later rendered into HTML pages viewed by other authenticated users. Because the injected content is treated as markup rather than text, embedded <script> tags or event handler attributes execute in the browser.
This is a stored (persistent) XSS pattern. The payload persists in Liferay's data store and is delivered repeatedly to every user who loads the affected Calendar view. Exploitation requires low-privileged authenticated access to create or edit a Calendar, and a target user must interact with the affected view.
Root Cause
The root cause is improper neutralization of input during web page generation [CWE-79]. The Calendar widget renders the Name attribute into the DOM without HTML-encoding characters such as <, >, and quotation marks. Server-side output filtering or context-aware escaping in the JSP or React component responsible for rendering Calendar metadata is missing or insufficient.
Attack Vector
An attacker with authenticated access and permission to create or modify a Calendar submits a crafted payload in the Name field. When any portal user, including administrators, opens a page containing the affected Calendar widget, the browser parses and executes the attacker-controlled script. The attacker can exfiltrate session cookies, issue authenticated API calls on behalf of the victim, or pivot to CSRF-style actions inside the portal.
No verified public proof-of-concept is available. The vulnerability is documented in the Liferay Known Vulnerability advisory for CVE-2025-43818.
Detection Methods for CVE-2025-43818
Indicators of Compromise
- Calendar entities whose Name field contains HTML tags, <script> blocks, on* event handlers, or javascript: URIs.
- Outbound HTTP requests from portal user browsers to unfamiliar domains immediately after loading pages containing Calendar widgets.
- Anomalous portal session activity, such as administrative API calls originating from user sessions that do not normally perform those actions.
Detection Strategies
- Query the Liferay database for Calendar records where the Name column contains characters such as <, >, or ", which indicate raw HTML rather than plain text.
- Inspect web application firewall (WAF) logs for POST requests to Calendar creation or update endpoints containing script-like payloads.
- Review Liferay audit logs for Calendar create and modify events performed by low-privileged accounts that do not normally manage Calendars.
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting to capture inline script violations on portal pages that render Calendar widgets.
- Alert on browser telemetry that shows script execution originating from Liferay portal pages contacting external hosts.
- Correlate Calendar edit events with subsequent privileged actions taken by users who viewed the affected Calendar.
How to Mitigate CVE-2025-43818
Immediate Actions Required
- Upgrade Liferay Portal to a fixed release above 7.4.3.110 and apply the corresponding DXP fix pack for your release train as listed in the vendor advisory.
- Audit existing Calendar entries for HTML or script content and sanitize or delete any suspicious Name values.
- Rotate session tokens and reset credentials for administrators who may have viewed a compromised Calendar.
Patch Information
Liferay has published patched versions and remediation guidance in the Liferay Known Vulnerability advisory for CVE-2025-43818. Customers on DXP subscriptions should apply the fix pack matching their update branch (7.3, 7.4, 2023.Q3, or 2023.Q4). Portal Community Edition users should upgrade to a release later than 7.4.3.110.
Workarounds
- Restrict Calendar creation and edit permissions to trusted roles until patches are applied.
- Deploy a WAF rule that blocks Calendar Name payloads containing <, >, or javascript: sequences.
- Enforce a strict CSP that disallows inline scripts (script-src 'self') on pages that host Calendar widgets to reduce exploitability.
# Example CSP header to reduce inline script execution on Liferay pages
# Add to your reverse proxy or Liferay portal-ext.properties web filter
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
