medium6.5
CVE-2026-53698
Silverpeas through 6.4.6 mishandles the "Personal space" feature that is selected when no componentId is set.
Impact
Silverpeas through 6.4.6 mishandles the "Personal space" feature that is selected when no componentId is set.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.silverpeas.core:silverpeas-core-war | <= 6.4-feature13197 | none recorded |
| maven | org.silverpeas.core:silverpeas-core | <= 6.4-feature13197 | none recorded |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-qv8h-rqr3-mph9
- https://nvd.nist.gov/vuln/detail/CVE-2026-53698
- https://github.com/Silverpeas/Silverpeas-Core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec
- https://github.com/Silverpeas/Silverpeas-Core/blob/983c5d07928b8a5ddcb39cc17d7fb9a0d87019b9/core-war/src/main/java/org/silverpeas/web/servlets/FileServer.java#L120-L122
- https://github.com/Silverpeas/Silverpeas-Core/blob/983c5d07928b8a5ddcb39cc17d7fb9a0d87019b9/core-war/src/main/java/org/silverpeas/web/servlets/FileServer.java#L150-L153
- https://tracker.silverpeas.org/issues/15229
- https://github.com/Silverpeas/Silverpeas-Core/releases/tag/6.4.7