CVE-2025-62266 Liferay Portal is vulnerable to DNS rebinding attacks

Medium 5.1 Published 30 Oct 2025 Updated 30 Oct 2025

Remote attackers can redirect users to arbitrary external URLs via DNS rebinding, requiring a configuration change to mitigate.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2025-62266?

CVE-2025-62266 is a medium-severity vulnerability in Liferay Digital Experience Platform, published on 30 Oct 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions is vulnerable to DNS rebinding attacks, which allows remote attackers to redirect users to arbitrary external URLs. This vulnerability can be mitigated by changing the redirect URL security from IP to domain.

Weakness: CWE-601

Which versions are affected by CVE-2025-62266?

2 open source packages ship an affected version, including com.liferay.portal:release.portal.bom. It affects 2 products.

Package	Affected	Fixed in
`com.liferay.portal:release.portal.bom` Maven	From `7.4.0-ga1`	`7.4.3.110`
`com.liferay.portal:release.portal.bom` Maven	From `7.4.0-ga1`	`7.4.3.110`

Products include Liferay Digital Experience Platform, Liferay Liferay Portal.

How do I fix CVE-2025-62266?

Upgrade com.liferay.portal:release.portal.bom to 7.4.3.110 or later.

Is CVE-2025-62266 being exploited?

There is no known exploitation of CVE-2025-62266 in the wild and no public exploit code.

All Liferay Digital Experience Platform vulnerabilities

Sources

Also known as GHSA-f5vh-4rj2-w8r8.