MEDIUM 6.5
GHSA-qv8h-rqr3-mph9
Silverpeas mishandles the "Personal space" feature that is selected when no componentId is set
Details
Silverpeas through 6.4.6 mishandles the "Personal space" feature that is selected when no componentId is set.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven / org.silverpeas.core:silverpeas-core-war
Introduced in:
0 No fixed version published yet for org.silverpeas.core:silverpeas-core-war (maven). Pin to a known-safe version or switch to an alternative.
Maven / org.silverpeas.core:silverpeas-core
Introduced in:
0 No fixed version published yet for org.silverpeas.core:silverpeas-core (maven). Pin to a known-safe version or switch to an alternative.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-53698 [ADVISORY]
- https://github.com/Silverpeas/Silverpeas-Core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec [WEB]
- https://github.com/Silverpeas/Silverpeas-Core [PACKAGE]
- https://github.com/Silverpeas/Silverpeas-Core/blob/983c5d07928b8a5ddcb39cc17d7fb9a0d87019b9/core-war/src/main/java/org/silverpeas/web/servlets/FileServer.java#L120-L122 [WEB]
- https://github.com/Silverpeas/Silverpeas-Core/blob/983c5d07928b8a5ddcb39cc17d7fb9a0d87019b9/core-war/src/main/java/org/silverpeas/web/servlets/FileServer.java#L150-L153 [WEB]
- https://github.com/Silverpeas/Silverpeas-Core/releases/tag/6.4.7 [WEB]
- https://tracker.silverpeas.org/issues/15229 [WEB]