Cross-Site Scripting (XSS) in Silverpeas Core via CKEditor Image Upload

Executive Summary

CVE-2026-78741 is a stored Cross-Site Scripting (XSS) vulnerability in Silverpeas Core versions 6.4.6 and earlier. It affects the wysiwyg-CKEditor image upload feature, allowing an authenticated attacker to inject malicious JavaScript code by modifying the filename during file upload. When the file is viewed or interacted with, the payload executes, potentially enabling session cookie theft or defacement.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Silverpeas Core versions 6.4.6 or earlier. Check for unusual file uploads in the wysiwyg-CKEditor image upload feature, particularly files with suspicious filenames or JavaScript payloads. Review server logs for unauthorized script execution or unexpected user interactions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute malicious scripts in the context of a user's session. This could lead to theft of session cookies, unauthorized actions on behalf of the user, defacement of web pages, or other malicious activities depending on the attacker's payload.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using vulnerable versions may face compliance violations if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Silverpeas Core to version 6.4.7 or later. If upgrading is not possible, disable the CKEditor image upload feature in Silverpeas. Monitor network traffic for suspicious file uploads and block known malicious payloads.

Useful 0 Not Useful 0