Silverpeas CVE-2026-53698

The attacker must be authenticated to Silverpeas with at least low-privilege credentials (confirmed by CVSS PR:L). The vulnerability is triggered specifically by submitting a request to the FileServer servlet with the componentId parameter absent or empty, which activates the Personal space fallback path in FileServer.java (lines 120-122 and 150-153). The FileServer endpoint must be network-reachable (AV:N). Limiting factors: unauthenticated attackers cannot exploit this vulnerability - a valid Silverpeas account is required; this is the single most significant exploitation barrier. Impact is restricted to confidentiality (file read); no write or denial-of-service primitives are exposed by this flaw. The traversal reach is bounded by the OS-level read permissions of the Silverpeas application process user.

The CVSS 6.5 score is well-supported by the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N: network-reachable, trivially exploitable once authenticated, with high confidentiality impact. PR:L (low privileges required) is the primary exploitation barrier - the attacker must hold a valid Silverpeas account - which limits mass opportunistic exploitation but remains a realistic threat in enterprise or multi-tenant deployments where many users hold credentials. Attack complexity is low (AC:L), meaning no special race conditions or configuration states are required beyond the absent componentId parameter. EPSS data was not provided in the available intelligence, so probability-of-exploitation-in-the-wild cannot be quantified. The vulnerability is not listed in CISA KEV, and no POC is referenced in the available data, indicating no confirmed or publicly demonstrated active exploitation at time of analysis. Despite a moderate CVSS score, the path traversal root cause and C:H rating warrant prioritized remediation in deployments storing sensitive documents, as credential files and configuration data could be exposed. No conflicting signals between available data points were identified.

An authenticated Silverpeas user sends a crafted HTTP GET request to the FileServer servlet omitting the ComponentId parameter, causing the server to enter the Personal space code path. The attacker supplies an absolute path or traversal sequence (e.g., ../../etc/passwd or an absolute filesystem path) in the SourceFile or Directory parameter, which FileServerUtils assembles into a raw filesystem path without sanitization. The server returns the contents of the targeted file - such as Silverpeas configuration files containing database credentials or system files - directly in the HTTP response.