CVE-2025-43829: Liferay Portal Commerce Shop is vulnerable to Stored XSS through SVG file

The analysis of the provided commit 288ba1f41f8c3374c80d7af27346eeebb8c780d0 clearly points to the vulnerable function. The commit message, 'LPD-15105 clean svg from malicious code', and the changes made in the D3Handler.js file confirm that the vulnerability lies in the handling of SVG files. The _printSVGImage function was identified as the vulnerable function because it was responsible for fetching and rendering the SVG content without proper sanitization. The patch adds the necessary sanitization steps to prevent the execution of malicious scripts embedded in the SVG file. Therefore, any runtime profile during the exploitation of this vulnerability would show the D3Handler._printSVGImage function in the stack trace as it processes the malicious SVG file.