What is GHSA-cwgh-r52j-xh6c?

GHSA-cwgh-r52j-xh6c is a security advisory published by GitHub Security Advisories with Medium severity. Liferay Portal Reflected Cross-Site Scripting Vulnerability in displayType Parameter

Which CVE IDs does GHSA-cwgh-r52j-xh6c cover?

GHSA-cwgh-r52j-xh6c covers the following CVE IDs: CVE-2025-43738. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-cwgh-r52j-xh6c?

GHSA-cwgh-r52j-xh6c affects 1 product, including: maven/com.liferay:com.liferay.expando.web:\u003c= 5.0.59.

GHSA-cwgh-r52j-xh6cMedium

Liferay Portal Reflected Cross-Site Scripting Vulnerability in displayType Parameter

Vendor

GitHub Security Advisories

Published

August 19, 2025

Last Modified

August 19, 2025

🔗 CVE IDs covered (1)

CVE-2025-43738 →

📋 Description

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.19 allows a remote authenticated user to inject JavaScript code via _com_liferay_expando_web_portlet_ExpandoPortlet_displayType parameter.

Liferay Portal is fixed on the master branch from commit acc4771.

🎯 Affected products1

maven/com.liferay:com.liferay.expando.web:<= 5.0.59

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-43738
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43738
https://github.com/liferay/liferay-portal/commit/acc477143b50de2138854548bc5bad06677e708a
https://liferay.atlassian.net/browse/LPE-18290
https://github.com/advisories/GHSA-cwgh-r52j-xh6c