CVE-2026-78742: Silverpeas Core XSS Vulnerability

CVE-2026-78742 Overview

CVE-2026-78742 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Silverpeas Core versions up to and including 6.4.6. The flaw resides in the Multimedia library application introduction field, where user-supplied input is rendered without proper sanitization. An attacker can inject malicious JavaScript that executes in the browser of any user who views the affected page. Exploitation requires user interaction but no authentication, and the vulnerability crosses trust boundaries (scope change), allowing session data or actions in other components to be affected.

Critical Impact
Successful exploitation enables an attacker to execute arbitrary script in a victim's browser session, leading to session hijacking, credential theft, or unauthorized actions within the Silverpeas collaborative platform.

Affected Products

Silverpeas Core versions <=6.4.6
Multimedia library application component
Deployments exposing the application introduction field to untrusted input

Discovery Timeline

2026-09-08 - CVE-2026-78742 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-78742

Vulnerability Analysis

The vulnerability is a stored or reflected Cross-Site Scripting flaw in the Multimedia library application within Silverpeas Core. The application introduction field accepts user-supplied content and renders it into the served HTML without adequate output encoding or input filtering. When a victim loads the affected view, injected script executes in the context of the Silverpeas origin.

The scope change component of the vulnerability indicates that the injected code can impact resources beyond the vulnerable component. In a collaborative platform such as Silverpeas, this typically means an attacker can leverage the executed script to reach other applications, user sessions, or administrative surfaces exposed to the same authenticated user.

Additional technical details are available in the Hekk Research writeup on CVE-2026-78742.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The Multimedia library's introduction field stores or reflects user input directly into HTML output without contextual encoding. HTML, JavaScript, and attribute contexts each require distinct escaping, and the absent sanitization allows <script> tags and event handler payloads to survive server-side processing.

Attack Vector

Exploitation occurs over the network and requires user interaction, such as clicking a crafted link or visiting a page containing the injected payload. An unauthenticated attacker who can submit content to the Multimedia library introduction field, or convince an application administrator to do so, can plant a payload that fires when any user loads the component. Because the vulnerability enables a scope change, the executed script can act against other integrated Silverpeas modules that share the browser session.

No public proof-of-concept exploit or exploit database entry is currently referenced for this CVE. Refer to the Hekk research writeup for reproduction details.

Detection Methods for CVE-2026-78742

Indicators of Compromise

HTTP requests to Silverpeas Multimedia library endpoints containing <script>, onerror=, onload=, or javascript: payloads within introduction or description parameters.
Unexpected outbound requests from user browsers to attacker-controlled domains shortly after loading a Multimedia library page.
Anomalous session token usage patterns, such as concurrent sessions from disparate geographic locations, following user visits to the affected page.

Detection Strategies

Inspect application logs and web server logs for POST or PUT requests to Multimedia library resources containing HTML control characters (<, >, ", ') in the introduction field.
Deploy a Web Application Firewall (WAF) rule set that flags XSS signature patterns targeting Silverpeas URI paths.
Perform authenticated dynamic application security testing (DAST) against /silverpeas/ Multimedia application endpoints to identify reflected and stored payload rendering.

Monitoring Recommendations

Enable Content Security Policy (CSP) violation reporting and monitor for script-src violations originating from Silverpeas pages.
Alert on any modification to Multimedia library introduction fields performed by unprivileged or newly created accounts.
Correlate Silverpeas access logs with authentication events to identify session anomalies that may indicate token exfiltration.

How to Mitigate CVE-2026-78742

Immediate Actions Required

Restrict access to the Multimedia library application to trusted, authenticated users until a patched release is deployed.
Audit existing Multimedia library entries for HTML or JavaScript content in introduction fields and remove or sanitize suspicious values.
Rotate active user session tokens if injection of payloads is suspected in production instances.

Patch Information

At the time of publication, no vendor patch reference is listed in the NVD entry for versions beyond 6.4.6. Administrators should monitor the Silverpeas project channels for a fixed release addressing CVE-2026-78742 and consult the Hekk research writeup for the latest guidance.

Workarounds

Deploy a strict Content Security Policy that disallows inline scripts and restricts script-src to trusted origins to blunt payload execution.
Configure a WAF rule to block or sanitize requests to Multimedia library endpoints containing HTML tags, event handlers, or javascript: URI schemes.
Limit the roles permitted to author or edit Multimedia library introductions to a minimal set of vetted administrators.

bash

# Example WAF rule (ModSecurity) blocking XSS payloads on Silverpeas Multimedia paths
SecRule REQUEST_URI "@contains /silverpeas/" \
    "chain,id:1078742,phase:2,deny,status:403,\
     msg:'CVE-2026-78742 Silverpeas Multimedia XSS attempt'"
    SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" \
        "t:none,t:urlDecodeUni,t:htmlEntityDecode"