CVE-2025-62248: A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal 7.4.0 through 7.4.

Quick answers

Is CVE-2025-62248 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-62248 being exploited in the wild.

How severe is CVE-2025-62248?

Medium severity, with a CVSS score of 4.8, published 22 October 2025.

Which products and versions are affected?

com.liferay:com.liferay.dynamic.data.mapping.web (Maven) ECOSYSTEM:introduced=0,last_affected=5.0.122.

Is there a fix for CVE-2025-62248?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Am I affected by CVE-2025-62248?

Check whether you run Liferay Digital Experience Platform, Liferay Portal or com.liferay:com.liferay.dynamic.data.mapping.web (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

• Liferay Digital Experience Platform
• Liferay Portal
• com.liferay:com.liferay.dynamic.data.mapping.web (Maven) ECOSYSTEM:introduced=0,last_affected=5.0.122

Identifiers

• CVE-2025-62248
• GHSA-phjr-p9c5-hprx