Executive brief
Silverpeas Core is an open-source collaborative portal and document management system used for team collaboration and content sharing. A stored cross-site scripting (XSS) vulnerability in the Multimedia library application's introduction editor allows authenticated managers to inject malicious JavaScript that executes in the browsers of other users viewing that library, potentially leading to session hijacking, credential theft, or malware distribution.
Technical details
This is a stored XSS vulnerability in the Multimedia library introduction feature of Silverpeas Core versions 6.4.6 and earlier. The vulnerable component is the HTML editor endpoint (POST /silverpeas/wysiwyg/jsp/htmlEditor.jsp) which fails to sanitize user-supplied input in the "editor1" parameter before storage. An authenticated user with Manager role can craft a POST request containing a JavaScript payload (e.g., <img src=x onerror=prompt(1);>) that persists in the database. When any user subsequently visits the Multimedia library overview page, the stored payload executes in their browser context with their privileges. The vulnerability requires authentication and the attacker must have Manager role access to the Multimedia library application. The fix was released in version 6.4.7.
Affected products
- Silverpeas Core <=6.4.6
Timeline
- 2026-09-05: disclosed
- 2026-09-08: patched: Fixed in version 6.4.7