CVE-2022-26596
Liferay Portal and Liferay DXP allows arbitrary injection via web content template names
Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web script or HTML via web content template names.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web script or HTML via web content template names.
- Record
CVE-2022-26596- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web script or HTML via web content template names.
- Record
CVE-2022-26596- Updated
- 2026-11-02
EUVDEUVD-2022-31151 No score
Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web script or HTML via web content template names.
- Record
EUVD-2022-31151- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w7f2-6896-6mm2
Liferay Portal and Liferay DXP allows arbitrary injection via web content template names
Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page before 5.0.15 in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web script or HTML via web content template names.
- Record
GHSA-w7f2-6896-6mm2- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-w7f2-6896-6mm2
Liferay Portal and Liferay DXP allows arbitrary injection via web content template names
Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page before 5.0.15 in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web script or HTML via web content template names.
- Record
GHSA-w7f2-6896-6mm2- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVBIT-liferay-2022-26596 No score
Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web script or HTML via web content template names.
- Record
BIT-liferay-2022-26596- Updated
- 2026-11-02
OSV No score
Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web script or HTML via web content template names.
- Record
CVE-2022-26596- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.liferay:com.liferay.journal.content.webMaven |
before 5.0.15 | 5.0.15 |
com.liferay.portal:release.dxp.bomMaven |
7.0.0 up to 7.0.10.fp94 | 7.0.10.fp94 |
com.liferay.portal:release.dxp.bomMaven |
7.1.0 up to 7.1.10.fp19 | 7.1.10.fp19 |
com.liferay.portal:release.dxp.bomMaven |
7.2.0 up to 7.2.10.fp8 | 7.2.10.fp8 |
liferayBitnami |
7.0.0 to 7.0.0, 7.1.0 to 7.1.0, 7.2.0 to 7.2.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0 | None known |
com.liferay:com.liferay.journal.content.webMaven |
before 5.0.15, plus listed versions 1.0.01.0.11.0.21.0.31.0.4 Show 45 moreShow less1.0.51.0.61.0.71.0.81.0.91.1.01.1.11.1.101.1.111.1.121.1.131.1.141.1.151.1.161.1.171.1.181.1.191.1.21.1.201.1.211.1.221.1.231.1.31.1.41.1.51.1.61.1.71.1.81.1.92.0.02.0.12.0.102.0.112.0.122.0.132.0.142.0.152.0.162.0.172.0.182.0.192.0.22.0.202.0.212.0.22 |
5.0.15 |
com.liferay.portal:release.dxp.bomMaven |
7.0.0 up to 7.0.10.fp94, plus listed versions 7.0.10.fp607.0.10.fp617.0.10.fp627.0.10.fp637.0.10.fp64 Show 31 moreShow less7.0.10.fp657.0.10.fp667.0.10.fp677.0.10.fp687.0.10.fp697.0.10.fp707.0.10.fp717.0.10.fp727.0.10.fp737.0.10.fp747.0.10.fp757.0.10.fp767.0.10.fp777.0.10.fp787.0.10.fp797.0.10.fp807.0.10.fp817.0.10.fp827.0.10.fp837.0.10.fp847.0.10.fp857.0.10.fp85-17.0.10.fp867.0.10.fp86-17.0.10.fp877.0.10.fp87-17.0.10.fp887.0.10.fp897.0.10.fp907.0.10.fp917.0.10.fp92 |
7.0.10.fp94 |
com.liferay.portal:release.dxp.bomMaven |
7.1.0 up to 7.1.10.fp19, plus listed versions 7.1.107.1.10.fp17.1.10.fp107.1.10.fp117.1.10.fp12 Show 14 moreShow less7.1.10.fp137.1.10.fp147.1.10.fp157.1.10.fp167.1.10.fp177.1.10.fp187.1.10.fp27.1.10.fp37.1.10.fp47.1.10.fp57.1.10.fp67.1.10.fp77.1.10.fp87.1.10.fp9 |
7.1.10.fp19 |
com.liferay.portal:release.dxp.bomMaven |
7.2.0 up to 7.2.10.fp8, plus listed versions 7.2.17.2.107.2.10.fp17.2.10.fp1-17.2.10.fp2 Show 5 moreShow less7.2.10.fp37.2.10.fp47.2.10.fp57.2.10.fp67.2.10.fp7 |
7.2.10.fp8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-26596 is a medium vulnerability (CVSS 6.1) in Liferay Portal, published April 25, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 54th percentile. Fixed in com.liferay:com.liferay.journal.content.web 5.0.15.
References
liferay.dev/w/cve-2022-26596-stored-xss-with-template-name
nvd.nist.gov/vuln/detail/CVE-2022-26596
liferay.com
github.com/liferay/liferay-portal/commit/c61976fc867f3add8eb429b99380e91f021f9313
Left out here: 169 versions. The JSON record has them.