CVEvulnerability
CVE-2026-53698
6.5 MEDIUM
Official page ↗
- Status
- Deferred
- Published
- 2026-06-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-36
Description
Silverpeas through 6.4.6 mishandles the "Personal space" feature that is selected when no componentId is set.
Related
Weakness · CWE (1)
- CWE-36 Absolute Path Traversal weakness
References
- https://github.com/Silverpeas/Silverpeas-Core/blob/983c5d07928b8a5ddcb39cc17d7fb9a0d87019b9/core-war/src/main/java/org/silverpeas/web/servlets/FileServer.java#L120-L122 github.com
- https://github.com/Silverpeas/Silverpeas-Core/blob/983c5d07928b8a5ddcb39cc17d7fb9a0d87019b9/core-war/src/main/java/org/silverpeas/web/servlets/FileServer.java#L150-L153 github.com
- https://github.com/Silverpeas/Silverpeas-Core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec github.com
- https://tracker.silverpeas.org/issues/15229 tracker.silverpeas.org