CVE-2025-43830: Liferay DXP Stored XSS Vulnerability

CVE-2025-43830 Overview

CVE-2025-43830 is a stored cross-site scripting (XSS) vulnerability affecting Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw resides in the Forms component and allows remote attackers to inject arbitrary web script or HTML through a crafted payload placed into a form field of the rich text type. Because the payload is stored server-side and rendered to any user who views the affected form, exploitation requires only that a victim interact with the form. The vulnerability is tracked under CWE-79 and carries a CVSS 4.0 base score of 5.1.

Critical Impact
Authenticated or anonymous attackers with access to submit rich text form input can persistently inject JavaScript that executes in the browser context of every user rendering the form, enabling session theft, phishing, and unauthorized actions on behalf of the victim.

Affected Products

Liferay Portal 7.3.2 through 7.4.3.111
Liferay DXP 2023.Q4.0 through 2023.Q4.5 and 2023.Q3.1 through 2023.Q3.8
Liferay DXP 7.4 GA through update 92, and 7.3 GA through update 35

Discovery Timeline

2025-10-08 - CVE-2025-43830 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43830

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the Forms feature of Liferay Portal and DXP. Rich text fields in forms accept HTML markup by design, but the affected versions do not sufficiently sanitize script-bearing content before persisting and rendering it. When a subsequent user loads the form, the browser parses the stored markup and executes attacker-controlled JavaScript in the origin of the Liferay instance. This gives the attacker access to session cookies, CSRF tokens, and any authenticated actions the victim can perform. Because the attack is stored, a single injection can compromise many users over time without further attacker interaction.

Root Cause

The root cause is improper neutralization of input during web page generation, classified as CWE-79. The rich text field type in the Forms component fails to strip or encode dangerous HTML constructs, allowing tags such as <script>, event handlers like onerror, and javascript: URI schemes to reach the rendered DOM.

Attack Vector

Exploitation occurs over the network and requires user interaction, meaning the victim must load a page containing the malicious form content. An attacker with permission to create or edit a form on the target Liferay instance inserts a crafted payload into a rich text field. When any legitimate user views the form, the stored script executes with the privileges of that user. In multi-tenant portals, this can escalate to administrator account compromise if a privileged user views the malicious content.

No public proof-of-concept exploit is currently available for CVE-2025-43830, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Liferay Security Advisory CVE-2025-43830 for vendor-provided technical detail.

Detection Methods for CVE-2025-43830

Indicators of Compromise

Form submissions to Liferay endpoints containing <script>, onerror=, onload=, or javascript: payloads within rich text field parameters.
Unexpected outbound HTTP requests from user browsers to attacker-controlled domains shortly after viewing a Liferay form page.
Anomalous session token reuse or authenticated actions originating from user accounts that recently accessed affected form pages.

Detection Strategies

Inspect Liferay application logs for form save operations that include HTML tags or JavaScript event handlers in rich text field values.
Deploy web application firewall (WAF) rules to flag XSS payload patterns in POST requests targeting Liferay Forms endpoints.
Correlate form editing activity with subsequent client-side errors or Content Security Policy (CSP) violation reports from viewers of the same form.

Monitoring Recommendations

Enable CSP violation reporting and forward reports to a centralized log store for review.
Monitor privileged user browsing sessions for JavaScript execution originating from user-generated content areas.
Track version and update levels across Liferay deployments to identify unpatched instances exposed to the vulnerability.

How to Mitigate CVE-2025-43830

Immediate Actions Required

Upgrade Liferay Portal and DXP installations to a fixed release as identified in the Liferay Security Advisory CVE-2025-43830.
Audit existing forms for suspicious HTML or script content in rich text fields, and remove or sanitize any injected markup.
Restrict form creation and editing permissions to trusted roles until patches are applied.

Patch Information

Liferay has published guidance for this issue in its known vulnerabilities portal. Administrators should apply the fixed update levels indicated by the vendor for their branch, which cover Liferay Portal releases after 7.4.3.111, DXP 7.4 update 92, DXP 7.3 update 35, and the affected 2023.Q3 and 2023.Q4 quarterly releases. See the Liferay Security Advisory CVE-2025-43830 for exact patched versions.

Workarounds

Configure a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Limit rich text field usage in public-facing forms and replace with plain text field types where feasible.
Place a WAF in front of Liferay to block requests containing common XSS payload signatures targeting Forms endpoints.

bash

# Example CSP header to reduce XSS impact on Liferay-hosted pages
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report