Cross-Site Scripting (XSS) in Silverpeas Core via Multimedia Library

Executive Summary

CVE-2026-78742 is a Stored Cross-Site Scripting (XSS) vulnerability in Silverpeas Core versions 6.4.6 and earlier. It affects the introduction section of the Multimedia library application. Authenticated users with manager privileges can inject malicious JavaScript code into the introduction field. When other users view the Multimedia library application, the injected script executes.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Silverpeas Core installations for versions 6.4.6 or earlier. Check the Multimedia library application's introduction field for suspicious JavaScript code or unusual payloads in the editor1 parameter. Review server logs for POST requests modifying this field. Use tools like Burp Suite or OWASP ZAP to intercept and analyze requests to the Multimedia library application.

Useful 0 Not Useful 0

Impact Analysis

An attacker with manager privileges could inject malicious scripts that run when other users access the Multimedia library. This could lead to theft of session cookies, account takeover, or defacement of the application. Users might unknowingly execute harmful code while browsing the library.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate GDPR by exposing user data through script execution or HIPAA by compromising protected health information if the application handles such data. It undermines data integrity and confidentiality requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Silverpeas Core to version 6.4.7 or later immediately. If upgrading is not possible, restrict manager privileges to trusted users and disable the Multimedia library application if unused. Monitor network traffic for suspicious POST requests to the introduction field and sanitize user inputs to prevent XSS attacks.

Useful 0 Not Useful 0