CVE-2025-43787: Liferay Portal's selection modal is vulnerable to XSS

September 12, 2025 (updated September 15, 2025)

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 allows an remote authenticated attacker to inject JavaScript through the organization site names. The malicious payload is stored and executed without proper sanitization or escaping.

References

github.com/advisories/GHSA-g8fh-pfw3-8rmr
github.com/liferay/liferay-portal
github.com/liferay/liferay-portal/commit/b230afddd5125dc5f858d68011ef93e9c47703a6
liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43787
nvd.nist.gov/vuln/detail/CVE-2025-43787

Code Behaviors & Features

Detect and mitigate CVE-2025-43787 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →