Is com.liferay:com.liferay.blogs.item.selector.web affected by CVE-2025-62275?

Maven com.liferay:com.liferay.blogs.item.selector.web is affected in <6.0.19.

Is CVE-2025-62275 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.2%.

medium

CVE-2025-62275

Q: Is CVE-2025-62275 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.2%.

Maven · com.liferay:com.liferay.blogs.item.selector.web

Summary

Liferay Portal and DXP do not check permissions of images in a blog entry

Severity: medium
EPSS: 0.2% (p15)
Also known as: GHSA-xf7m-v66q-76w8
Published: 2025-11-01

References

https://nvd.nist.gov/vuln/detail/CVE-2025-62275
https://github.com/liferay/liferay-portal/commit/9856c55bcbb3b8ce1276117709b9c0082a19c62c
https://github.com/liferay/liferay-portal/commit/e0ae29cfdb8d10a6fddc56d04ca3ae88c3fbc7f3

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.