What is GHSA-jhgr-j9cj-8j62?

GHSA-jhgr-j9cj-8j62 is a security advisory published by GitHub Security Advisories with Medium severity. Liferay Portal is vulnerable to Reflected XSS attack through get_editor path

Which CVE IDs does GHSA-jhgr-j9cj-8j62 cover?

GHSA-jhgr-j9cj-8j62 covers the following CVE IDs: CVE-2025-43783. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-jhgr-j9cj-8j62?

GHSA-jhgr-j9cj-8j62 affects 1 product, including: maven/com.liferay:com.liferay.frontend.editor.ckeditor.web:\u003e= 5.0.76, \u003c 5.0.102.

GHSA-jhgr-j9cj-8j62Medium

Liferay Portal is vulnerable to Reflected XSS attack through get_editor path

Vendor

GitHub Security Advisories

Published

September 10, 2025

Last Modified

December 20, 2025

🔗 CVE IDs covered (1)

CVE-2025-43783 →

📋 Description

A reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 allows remote attackers to inject arbitrary web script or HTML via the /c/portal/comment/discussion/get_editor path.

🎯 Affected products1

maven/com.liferay:com.liferay.frontend.editor.ckeditor.web:>= 5.0.76, < 5.0.102

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-43783
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43783
https://github.com/liferay/liferay-portal/commit/d7f9e94e0ebb63b04ac77d6253fe16dbd914bdf1
https://liferay.atlassian.net/browse/LPE-18085
https://github.com/advisories/GHSA-jhgr-j9cj-8j62