CVE-2026-78738: Silverpeas Core 6.4.6 XSS Vulnerability

CVE-2026-78738 Overview

CVE-2026-78738 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Silverpeas Core version 6.4.6. The flaw resides in the Document management file upload feature, which fails to properly sanitize user-supplied input before rendering it in the browser. An attacker can craft a malicious file that triggers script execution when a victim interacts with the uploaded content.

Silverpeas is an open-source collaborative portal used for document management, workflow, and enterprise content sharing. Successful exploitation enables session hijacking, credential theft, and unauthorized actions performed in the context of the victim's browser session.

Critical Impact
Attackers can execute arbitrary JavaScript in the context of authenticated Silverpeas users, enabling session theft and unauthorized actions across the collaborative portal.

Affected Products

Silverpeas Core 6.4.6
Deployments using the Document management module
Web clients rendering uploaded document content from Silverpeas

Discovery Timeline

2026-09-08 - CVE-2026-78738 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-78738

Vulnerability Analysis

The vulnerability is a stored or reflected Cross-Site Scripting flaw in the Silverpeas Core 6.4.6 Document management file upload feature. The application accepts file metadata or content without adequately encoding output when rendered back to users.

When an authenticated user views the uploaded document or its metadata, embedded script payloads execute in the victim's browser. The flaw sits within the trust boundary of the application, meaning the injected script runs with the victim's active session cookies and portal permissions.

The scope-changed nature of the vulnerability indicates the injected content can affect resources beyond the vulnerable component itself, extending impact to other application contexts that consume the tainted data. User interaction is required for exploitation.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The Document management upload handler does not enforce strict output encoding or content-type validation on user-controlled fields such as filenames, metadata, or embedded document content. Client browsers subsequently interpret attacker-supplied HTML or JavaScript as executable code.

Attack Vector

Exploitation requires an attacker to upload a document containing a malicious payload through the Document management interface. Depending on the deployment configuration, this may be possible for unauthenticated attackers or users with basic upload privileges.

When a second user opens or previews the document, the payload executes in their browser session. Attackers commonly leverage this class of flaw to steal session tokens, perform CSRF-style actions, deface content, or pivot to internal application endpoints. See the Hekk Research writeup for technical details on the payload delivery mechanism.

Detection Methods for CVE-2026-78738

Indicators of Compromise

Uploaded documents with filenames containing HTML tags, <script> blocks, or JavaScript URI schemes such as javascript:
Unusual outbound requests from user browsers to attacker-controlled domains after viewing Silverpeas documents
Session token values appearing in web server access logs or referer headers of external domains
Unexpected administrative actions performed by legitimate user accounts shortly after document access

Detection Strategies

Inspect Silverpeas access logs for POST requests to the Document management upload endpoints containing suspicious payload patterns
Deploy a Web Application Firewall (WAF) rule set to flag XSS signatures in multipart form uploads targeting Silverpeas
Correlate document upload events with subsequent anomalous user session activity in the same portal

Monitoring Recommendations

Enable verbose logging on the Silverpeas Document management module and forward logs to a centralized SIEM
Monitor Content Security Policy (CSP) violation reports from browsers accessing the Silverpeas portal
Alert on outbound HTTP requests from user endpoints to unknown domains immediately following portal document access

How to Mitigate CVE-2026-78738

Immediate Actions Required

Restrict Document management upload privileges to trusted user roles until a patched version is deployed
Review recently uploaded documents in Silverpeas 6.4.6 for suspicious filenames or embedded scripts and quarantine anomalies
Force session invalidation for users who accessed potentially malicious documents

Patch Information

No vendor patch reference is listed in the current NVD entry for CVE-2026-78738. Administrators should monitor the Silverpeas project releases and the Hekk Research advisory for updates, and upgrade to a version later than 6.4.6 when available.

Workarounds

Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Configure a WAF to inspect and block XSS payloads in multipart file upload requests targeting the Document management endpoints
Serve uploaded documents from a sandboxed, cookie-less domain to isolate any executed script from the primary application session
Enforce filename sanitization at the reverse proxy layer to strip HTML metacharacters before requests reach Silverpeas

bash

# Example nginx configuration to enforce CSP and block script-bearing filenames
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'" always;
add_header X-Content-Type-Options "nosniff" always;

location /silverpeas/ {
    if ($request_uri ~* "(<|>|script|javascript:)") {
        return 403;
    }
    proxy_pass http://silverpeas_backend;
}