Executive brief
Silverpeas is a collaborative portal software used for document management and team workspaces. When no component ID is provided, the application incorrectly handles the "Personal space" feature, allowing authenticated users to access files outside their intended directory through path traversal. This could expose sensitive documents and configuration files stored on the server.
Technical details
This vulnerability is an absolute path traversal (CWE-36) in the FileServer servlet component. When a request is made without a componentId parameter, the application fails to properly validate and sanitize file paths, allowing an attacker to construct requests that access files outside the intended "Personal space" directory. The vulnerability requires authentication (low privilege level) and no user interaction, accessed over the network via HTTP requests. An authenticated attacker can read arbitrary files with high confidentiality impact. The vulnerability was fixed in version 6.4.7, as indicated by the commit caa6e6d and the subsequent release tag.
Affected products
- Silverpeas Silverpeas Core ≤ 6.4.6
- Silverpeas Silverpeas Core WAR ≤ 6.4-feature13197
Timeline
- 2026-06-10: disclosed
- 2026-07-16: patched: Fixed in version 6.4.7
References
- https://github.com/Silverpeas/Silverpeas-Core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec
- https://github.com/Silverpeas/Silverpeas-Core/blob/983c5d07928b8a5ddcb39cc17d7fb9a0d87019b9/core-war/src/main/java/org/silverpeas/web/servlets/FileServer.java
- https://github.com/Silverpeas/Silverpeas-Core/blob/983c5d07928b8a5ddcb39cc17d7fb9a0d87019b9/core-war/src/main/java/org/silverpeas/web/servlets/FileServer.java
- https://tracker.silverpeas.org/issues/15229
- https://github.com/Silverpeas/Silverpeas-Core/releases/tag/6.4.7