Cross Site Scripting in Silverpeas Core 6.4.6

Executive Summary

CVE-2026-78738 is a stored Cross-Site Scripting (XSS) vulnerability in Silverpeas Core 6.4.6. It allows attackers to inject malicious JavaScript via the Document management file upload feature by modifying the X-FULL-PATH header with a URL-encoded XSS payload. The script executes when a user clicks the preview button of the uploaded file.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Silverpeas Document management file uploads for suspicious headers or payloads. Check for modified X-FULL-PATH headers containing JavaScript code. Review logs for users with Manager, Publisher, or Writer roles uploading files in workspaces with the Document management application.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of the user, or redirect users to malicious sites. The impact depends on user privileges; authenticated users with specific roles (Managers, Publishers, or Writers) can exploit this to target other users in the same workspace.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations using affected versions may face compliance violations and potential fines.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Silverpeas Core to version 6.4.7 or later immediately. Disable file uploads in the Document management application if possible. Restrict upload permissions to trusted users only. Monitor for unusual file uploads or header modifications.

Useful 0 Not Useful 0