CVE-2025-62240: Liferay Portal is vulnerable to XSS through its Calendar Events parameters

The vulnerability lies in the com.liferay.calendar.web.internal.util.CalendarUtil.toCalendarBookingJSONObject function, which is responsible for creating a JSON object representing a calendar booking. The provided patch 961b569fbd9207c728a93d962e989dbc062f6fb6 clearly shows that the name of the calendar resource, obtained via calendarResource.getName(themeDisplay.getLocale()), was being directly returned without any sanitization. The fix involves wrapping this call with HtmlUtil.escape(), which prevents malicious scripts from being injected into the output. The vulnerability could be exploited by a remote attacker by crafting a payload and injecting it into a user's name fields, which are then used as calendar resource names. When the calendar event is viewed, the malicious script would execute in the victim's browser.