Summary
htmlEditor.jsp in Silverpeas through 6.4.6 concatenates the ReturnUrl request parameter into a JavaScript string without context-appropriate encoding. An attacker can execute JavaScript in an authenticated victim’s session when the victim visits a crafted editor URL and activates the Back control.
Technical details
The editor readsReturnUrl from the request and stores it for later use:
');alert(document.domain);sp.navRequest(' closes the first call, inserts JavaScript, and starts another call so that the resulting handler remains syntactically valid.
HTML encoding alone is not sufficient at this sink. The untrusted value is inside a JavaScript string, where quotes, backslashes, and line terminators need JavaScript-context encoding.
Reproduction
1. Send the editor URL to an authenticated user
The crafted ReturnUrl request reaches the authenticated editor
2. Activate the Back control
The page renders the supplied input into the button action:
The payload inserted into the Back button's JavaScript action
JavaScript executing after the victim clicks Back
Complete ReturnUrl reflected-XSS sequence
Impact
The attacker can run JavaScript in the Silverpeas origin with access to the victim’s authenticated session. Exploitation has two interaction requirements: the victim must open the crafted editor URL while signed in and then click Back. This makes the finding less practical than CVE-2026-53695, but the sink still permits arbitrary script execution.Remediation
Upgrade to Silverpeas 6.4.7 or later. EncodeReturnUrl for a JavaScript string before interpolation. For example, the OWASP Java Encoder provides Encode.forJavaScript(returnUrl). A safer design is to avoid generating javascript: URLs and attach behavior without placing untrusted data inside executable code.