CVE-2025-43753: Liferay Portal Reflected Cross-Site Scripting Vulnerability via Form Container

The analysis of the provided commits, particularly 6ebe926008776c3f741f989a884ad07f02a79d9f, points directly to a vulnerability within the getSuccessMessage method of the RenderLayoutStructureDisplayContext class. The vulnerability is a classic reflected XSS, where user-controllable input (in this case, a success message associated with a form) is rendered on the page without proper output encoding or sanitization.

The patch introduces a call to HtmlUtil.escape() on the success message string before it is returned. This is a clear indication that the function was previously vulnerable to HTML and script injection. The accompanying test commits, such as d835c7331e38e048972ab4b8cf3106fc6767015f, confirm this by adding a test case that injects a <script> tag into the success message and asserts that the output is correctly escaped. Therefore, any runtime profile capturing the exploitation of this vulnerability would show the com.liferay.layout.taglib.internal.display.context.RenderLayoutStructureDisplayContext.getSuccessMessage function in the stack trace as it processes the malicious input.