What is GHSA-gccf-r9xp-x8jx?

GHSA-gccf-r9xp-x8jx is a security advisory published by GitHub Security Advisories with Low severity. Liferay Portal Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page

Which CVE IDs does GHSA-gccf-r9xp-x8jx cover?

GHSA-gccf-r9xp-x8jx covers the following CVE IDs: CVE-2025-62255. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-gccf-r9xp-x8jx?

GHSA-gccf-r9xp-x8jx affects 1 product, including: maven/com.liferay:com.liferay.knowledge.base.web:\u003c 5.0.109.

GHSA-gccf-r9xp-x8jxLow

Liferay Portal Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page

Vendor

GitHub Security Advisories

Published

October 23, 2025

Last Modified

October 23, 2025

🔗 CVE IDs covered (1)

CVE-2025-62255 →

📋 Description

Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an attachment's filename.

🎯 Affected products1

maven/com.liferay:com.liferay.knowledge.base.web:< 5.0.109

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-62255
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62255
https://github.com/liferay/liferay-portal/commit/46dd9b77cc2514761828d9b483a1dfe5d6e6b76d
https://liferay.atlassian.net/browse/LPE-17842
https://github.com/advisories/GHSA-gccf-r9xp-x8jx