CVE-2025-43761: Liferay Portal Reflected XSS in CKEditor component

CVE-2025-43761 · Severity: medium · CVSS 4 · Published 2025-08-22

Liferay Portal and DXP are enterprise platforms used for building digital experiences and corporate portals. A security flaw in the integrated CKEditor component allows attackers to execute malicious scripts in a user's browser. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.

Technologies: Liferay Portal, com.liferay:com.liferay.frontend.editor.ckeditor.web (Maven). Vendors: Liferay, Maven, npm.

Quick answers

Is CVE-2025-43761 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-43761 being exploited in the wild.
How severe is CVE-2025-43761?
Medium severity, with a CVSS score of 4, published 22 August 2025.
Which products and versions are affected?
Liferay DXP 2024.Q4.0 through 2024.Q4.4, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12; Liferay Portal 7.4.0 through 7.4.3.131, 7.4 GA through update 92; com.liferay:com.liferay.frontend.editor.ckeditor.web (Maven) ECOSYSTEM:introduced=0,fixed=5.0.107; com.liferay:com.liferay.frontend.js.dependencies.web (Maven) ECOSYSTEM:introduced=0,fixed=1.0.25; and 1 more.
Is there a fix for CVE-2025-43761?
Yes. com.liferay:com.liferay.frontend.editor.ckeditor.web (Maven): upgrade to 5.0.107 or later; com.liferay:com.liferay.frontend.js.dependencies.web (Maven): upgrade to 1.0.25 or later; liferay-ckeditor (npm): upgrade to 4.21.0-liferay.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-43761 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2025-43761?
Check whether you run Liferay DXP, Liferay Portal, com.liferay:com.liferay.frontend.editor.ckeditor.web (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.liferay:com.liferay.frontend.editor.ckeditor.web (Maven): upgrade to 5.0.107 or later
    # set com.liferay:com.liferay.frontend.editor.ckeditor.web to 5.0.107 in your pom.xml or build.gradle
  • com.liferay:com.liferay.frontend.js.dependencies.web (Maven): upgrade to 1.0.25 or later
    # set com.liferay:com.liferay.frontend.js.dependencies.web to 1.0.25 in your pom.xml or build.gradle
  • liferay-ckeditor (npm): upgrade to 4.21.0-liferay.10 or later
    npm install liferay-ckeditor@4.21.0-liferay.10

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in Liferay Portal and Liferay DXP due to improper input neutralization in the CKEditor component. Specifically, the endpoint at 'frontend-editor-ckeditor-web/ckeditor/samples/old/ajax.html' fails to adequately sanitize user-supplied input. An unauthenticated remote attacker can exploit this by crafting a malicious URL that, when visited by a victim, executes arbitrary JavaScript in the context of the victim's browser session. This can result in session hijacking or unauthorized manipulation of the web interface. The issue has been addressed by updating the 'liferay-ckeditor' dependency to version 4.21.0-liferay.10.

Affected products

  • Liferay Liferay Portal 7.4.0 through 7.4.3.131, 7.4 GA through update 92
  • Liferay Liferay DXP 2024.Q4.0 through 2024.Q4.4, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12

Identifiers

  • CVE-2025-43761
  • GHSA-3h7r-4xxj-3mfm

Timeline

  • 2025-08-22: disclosed
  • 2025-08-22: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.