What is the CVSS score of CVE-2026-53698?

CVE-2026-53698 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Silverpeas CVE-2026-53698

EUVD-2026-36068 MEDIUM

Absolute Path Traversal (CWE-36)

2026-06-10 mitre

GHSA-qv8h-rqr3-mph9

Information Disclosure Silverpeas

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 10, 2026 - 16:21 vuln.today

Analysis Generated

Jun 10, 2026 - 16:21 vuln.today

DescriptionNVD

Silverpeas through 6.4.6 mishandles the "Personal space" feature that is selected when no componentId is set.

AnalysisAI

Absolute path traversal (CWE-36) in Silverpeas through 6.4.6 allows authenticated remote users to read arbitrary files from the server filesystem by exploiting the 'Personal space' fallback path in the FileServer servlet, activated when no componentId parameter is supplied. The CVSS vector confirms network-reachable, low-complexity exploitation requiring only low-privilege credentials, with high confidentiality impact and no integrity or availability loss. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Silverpeas is a Java-based enterprise collaborative content management platform. The vulnerability resides in the FileServer servlet (core-war/src/main/java/org/silverpeas/web/servlets/FileServer.java, specifically lines 120-122 and 150-153) and the companion FileServerUtils utility class. CWE-36 (Absolute Path Traversal) indicates that user-controlled input - such as SourceFile or Directory parameters - is used to construct filesystem paths without stripping absolute path references or directory traversal sequences. When componentId is absent from the request, the servlet activates a 'Personal space' code path that bypasses the normal component-scoped path restrictions, enabling reads outside the intended attachment storage directories. The upstream fix (commit caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec) removes legacy URL-building methods including getWebUrl, getAliasURL, getMappedUrl, and replaceSpecialChars from FileServerUtils, eliminating the raw-parameter path assembly that enabled traversal, and converts FileServer to a managed bean via @Bean annotation for tighter lifecycle and security control. CPE cpe:2.3:a:silverpeas:silverpeas:*:*:*:*:*:*:*:* covers all versions.

RemediationAI

The upstream fix is available as commit caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec in the Silverpeas-Core GitHub repository (https://github.com/Silverpeas/Silverpeas-Core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec); a specific released version number incorporating this fix has not been independently confirmed from available data (upstream fix available via commit; released patched version not independently confirmed). Administrators should monitor the Silverpeas release channel and upgrade to the first version that includes this commit. As a compensating control prior to patching, a WAF or reverse proxy rule rejecting HTTP requests to the FileServer servlet where the ComponentId parameter is absent or empty would block the specific trigger condition for this vulnerability - note that this may impact legitimate Personal space file access for end users. Additionally, restricting Silverpeas process-user OS permissions to the minimum required directories limits the scope of files an attacker could read even if exploitation occurs.