CVE-2026-78741: Silverpeas Core XSS Vulnerability

CVE-2026-78741 Overview

CVE-2026-78741 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Silverpeas Core versions up to and including 6.4.6. The flaw resides in the wysiwyg-CKEditor image upload feature. Attackers can inject malicious script payloads that execute in the browser context of users who interact with crafted content. Exploitation requires user interaction and can be triggered over the network without authentication.

Critical Impact
Successful exploitation enables session hijacking, credential theft, and unauthorized actions performed under the victim's browser context within the Silverpeas collaboration platform.

Affected Products

Silverpeas Core versions <= 6.4.6
The wysiwyg-CKEditor image upload component bundled with Silverpeas Core
Deployments exposing the CKEditor image upload endpoint to authenticated or unauthenticated users

Discovery Timeline

2026-09-08 - CVE-2026-78741 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database
2026-09-10 - EPSS score published at 0.181%

Technical Details for CVE-2026-78741

Vulnerability Analysis

The vulnerability affects the WYSIWYG CKEditor integration inside Silverpeas Core. Specifically, the image upload feature fails to sanitize or validate user-supplied input before rendering it back to the browser. This allows attackers to inject arbitrary JavaScript that executes in the context of the Silverpeas application.

Because Silverpeas is an enterprise collaboration platform, injected scripts can access authenticated sessions, extract cookies, or issue requests on behalf of the victim. The scope change in the CVSS vector indicates that impact extends beyond the vulnerable component into the broader browser session. Attackers require the victim to load or interact with attacker-controlled content, typically by uploading a crafted image or viewing a manipulated resource.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The CKEditor image upload handler does not enforce sufficient validation on filenames, metadata, or embedded content before storing and reflecting the values. Reflected or stored payloads then execute when the resource is rendered inside a Silverpeas page.

Attack Vector

An attacker crafts an image upload request containing HTML or JavaScript payloads in fields processed by the CKEditor handler. When another user views the affected page, the browser executes the injected script. See the Hekk Research analysis of CVE-2026-78741 for the technical write-up.

Synthetic exploit code is not provided. Consult the referenced research for payload construction details and reproduction steps.

Detection Methods for CVE-2026-78741

Indicators of Compromise

Unusual image upload requests to the CKEditor endpoint containing HTML tags, <script> fragments, or JavaScript event handlers in filenames or metadata
Stored content in Silverpeas repositories containing encoded payloads such as javascript:, onerror=, or onload= attributes
Anomalous outbound requests from user browsers to attacker-controlled domains shortly after loading Silverpeas pages

Detection Strategies

Inspect web server and application logs for POST requests to the wysiwyg-CKEditor image upload endpoint with suspicious filename patterns
Deploy Content Security Policy (CSP) violation reporting to surface script execution attempts blocked by browser policy
Review stored user-generated content for HTML or JavaScript embedded in image metadata fields

Monitoring Recommendations

Enable verbose logging on the Silverpeas application server, focusing on file upload handlers
Correlate authentication events with unexpected privileged actions that may indicate session takeover
Monitor for outbound connections from user workstations to unfamiliar domains after Silverpeas usage

How to Mitigate CVE-2026-78741

Immediate Actions Required

Restrict access to the Silverpeas WYSIWYG editor and image upload functionality to trusted users only
Deploy a web application firewall (WAF) rule set that blocks HTML and JavaScript payloads in file upload requests
Audit existing uploaded content for stored XSS payloads and remove malicious artifacts

Patch Information

No vendor patch reference is included in the NVD data at the time of publication. Administrators should monitor the Silverpeas project channels and the Hekk Research advisory for updated fix versions beyond 6.4.6.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Disable the CKEditor image upload feature if it is not required for business operations
Apply server-side input validation and output encoding on all fields processed by the CKEditor handler

bash

# Example CSP header to reduce XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self';";