CVE-2025-62253

Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter.

CVSS 4.0

6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-25)

CWE

CWE-601

Published

2025-10-27

Modified

2026-10-18

Record from

the NVD, synced 2026-10-19

Affected

• liferay:digital_experience_platform
• liferay:liferay_portal

Packages (OSV)

References

• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62253

Check your stackJSON