CVE-2026-53698

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53698
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53698.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53698
Published
2026-06-10T00:00:00Z
Modified
2026-07-15T19:09:28.389525Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

Silverpeas through 6.4.6 mishandles the "Personal space" feature that is selected when no componentId is set.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53698.json",
    "cwe_ids": [
        "CWE-36"
    ],
    "cna_assigner": "mitre"
}
References

Affected packages

Git / github.com/silverpeas/silverpeas-core

Affected ranges

Type
GIT
Repo
https://github.com/silverpeas/silverpeas-core
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
5015c59db6d4863ca049274910c1b8d471cba035
Fixed
caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.4.6"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

6.*
6.0-alpha1
6.0-alpha2
6.0-alpha3
6.0-beta1
6.0-rc1
6.0-rc2
6.0-rc3
6.4
core-5.*
core-5.11
core-5.12
core-5.6
core-5.7

Database specific

vanir_signatures 
[
    {
        "source": "https://github.com/silverpeas/silverpeas-core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec",
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "79030508359798464903502427324191722982",
            "length": 419.0
        },
        "id": "CVE-2026-53698-0ba4d7c2",
        "signature_type": "Function",
        "target": {
            "function": "getWebUrl",
            "file": "core-library/src/main/java/org/silverpeas/core/util/file/FileServerUtils.java"
        }
    },
    {
        "source": "https://github.com/silverpeas/silverpeas-core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec",
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "60507207838188134108887599321006013365",
            "length": 154.0
        },
        "id": "CVE-2026-53698-17ef51cb",
        "signature_type": "Function",
        "target": {
            "function": "getUrl",
            "file": "core-library/src/main/java/org/silverpeas/core/util/file/FileServerUtils.java"
        }
    },
    {
        "source": "https://github.com/silverpeas/silverpeas-core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec",
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "103959518776543354182857808214429403432",
            "length": 211.0
        },
        "id": "CVE-2026-53698-2e255295",
        "signature_type": "Function",
        "target": {
            "function": "replaceSpecialChars",
            "file": "core-library/src/main/java/org/silverpeas/core/util/file/FileServerUtils.java"
        }
    },
    {
        "source": "https://github.com/silverpeas/silverpeas-core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec",
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "100363168111302556233559315981732492696",
                "255303660874485888163795800186947113612",
                "37949352185916795404641336836796312818",
                "93263417965464359197486345174803466624",
                "22024254149566286342687843728063641767",
                "303569501222285029689873162610473825378",
                "100043911649687559094879956939092136750",
                "69046029111189559958028064258343811529",
                "72653924797438131351007506883017554472",
                "27512051165859122698803903004367067181",
                "159129331030756066273437937784943616349",
                "70818191559154728435609531537332011296",
                "250746076416336812398932559825346747419",
                "45398460648864238571608684870859371361",
                "73242929178989631286517375010254703658",
                "161543288961369849127944667229332233457",
                "96051715838888015470273468403987769821",
                "240287142142270631577275565726481748824",
                "73099139414397787394557148257542991053",
                "7335174453929712784579036709700644931",
                "170483687570309549687816889579415831237",
                "156855081846124392724450593600510225569",
                "219919410801822481886583635671131411008",
                "31995156520915832660680202805129711185",
                "29928611079515149601242732175801602029",
                "163699986284789630052813536488044928056",
                "297585142361818224648169981611547282239",
                "187306352820567281037074424296836747840",
                "131835316430615035097278814590580479514",
                "200860424080533681483216092901393366340",
                "218118084182732659655863692378294631346",
                "69534245749150303698216188283706755388",
                "126445237262752942947671815617160987318",
                "92021843187781666428024518181780730673",
                "18105916148105666997386716841988115661",
                "87280739621783329490309769116912408409",
                "7893668278015331997646298771617645143",
                "62433359163174405769287443366939793639",
                "51759598343827125652214896833615493256",
                "286673522671239023726434498755097928018",
                "210441892750691857234433249958927003720",
                "199260408368454026835430642955896386304",
                "139673720824107218241572515937036742101",
                "148654265645561295947616372168557505908",
                "56317943182646446120973705059867122762",
                "188557416506954109951192042812782492359",
                "9928575302024141612433497869107041931",
                "230474797618239299858474872169655945066",
                "321400104279158422734117253822040940925",
                "288772619417003069310445041473280426476",
                "49110425656591845870378615352312674021",
                "215862216384287576708464729435591303692",
                "113978261414602261676088928717398053282",
                "51529347279107637153617018475952327541",
                "6717229848453940673278249606359505465",
                "295055383711623111038296574244487918223",
                "296027403665436870816310967847243553941",
                "327410215960903776014557488846188246123",
                "328689153498589269810201896079156227119",
                "96488657985241541016804787306136632156",
                "15764859444746653072824174366516064082",
                "74164348373044007154863836166619017696",
                "79291255971328937696363940890005053223",
                "165623185373362484579311402487163422445",
                "306162522505077023407768996947906882751",
                "289561967439733700431250953862904212853",
                "171613487209608143055539541311289757170",
                "39258995790897037796791469616399115654"
            ]
        },
        "id": "CVE-2026-53698-41d2cca5",
        "signature_type": "Line",
        "target": {
            "file": "core-library/src/main/java/org/silverpeas/core/util/file/FileServerUtils.java"
        }
    },
    {
        "source": "https://github.com/silverpeas/silverpeas-core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec",
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "22298557384674626337430403900388439606",
                "86276038461003395107789716898782802304",
                "185963825275918152913686580045941209574",
                "334767068807449834073027991414172195872",
                "83451024782128675001482293197245299851",
                "34390105922193855559934233059918338168",
                "70202618807695699591255824846108104701",
                "242977127993699333569209593331239458460",
                "77147669263292212399935270744860246160",
                "53659358289440835732617997266952381717",
                "331099601135517378291928172960982714453",
                "251886811907812039097371445917760871966",
                "236213808377414567136691630996249446018",
                "188797031974429797367104523813233296936",
                "139915535198074601445198214635547441278",
                "339127948264338413643494520471713595560",
                "131445968662890322321028856333298482518",
                "118938741235220223899015203029088740791",
                "89680362497448579955099806572853726612",
                "36344526257924172554421058501083293552",
                "290877549843406602493177262395677841337",
                "22728712514597732565747671920319880962",
                "258212385164214493106972013363753578874",
                "248690581750133348485314670136082358094",
                "175209949223472089358564734715592974197",
                "280838924812087745805988814619299845834",
                "336030481506597511042816563132827167096",
                "94936042600069601698037361875173941588",
                "118749176220998787231126492215457480297",
                "12461167636314524779050210333221862742",
                "57059963297428660362666991359901551999",
                "261037881842967918228774600487372739313",
                "49115866441935950476035139375737512604",
                "98790867228284376050946502364831493991",
                "24875213328874455189595192605416340890",
                "214855689944041615036960533888158491731",
                "47228892332103418463603042350517850614",
                "217200187383189955930865022293065318655",
                "23016145200387104830708570624219329103",
                "114158513912645591198418993382368283908",
                "105797006917840393756235247077950674027",
                "165221616713216315575788918913345784355",
                "279201473389465798138888706853798588063",
                "331177456748576129708741962132618009110",
                "287572911631567041607129507240397449471",
                "99963301191921613945657783777150352685",
                "310494223632030144750868633063004130440",
                "164937912537636379158769386988291561021",
                "181431536666240915536143704077235634789",
                "303946395405040517130268594234660990320",
                "14642583323770956418364568757704553914",
                "211935997516064167288367917426879196741",
                "143940646718233896595209187075210163153",
                "49817578127786355847757842205945773965",
                "240234359179064131709865738250362290674",
                "166333988608432004809453512286633795297",
                "100787064249212975483723250640225662504",
                "137509627024348917860094998710330983466",
                "65382436048396380575575006743357430972",
                "167314860043563994339704852723429722145",
                "171901750483038779755173045691162414781",
                "291382816173037441906172068002578999450",
                "44901610104233996941589165932646614096",
                "277935427943164608329648629413684683848",
                "173670997614690500691934089342253572174",
                "205034692502276213580247833738151929582",
                "306400937910760498252484563922191993936",
                "85067644903380705128409088534547423098",
                "207196410369505713227617683488497198463",
                "39847644429004506501445090564973538389",
                "252720978267275014408744655130340042921",
                "22679121357113504948205570994058934237",
                "171476371266132101721923603443625105108",
                "94355586617269231179150889240803370409",
                "250139177097818223298054523435766594649",
                "81376386098025475452856842491105047722",
                "2424995556949976359114728041434950321",
                "96206780019320486641317307563381844093",
                "209437581212264849681871748690716383832",
                "312467634592847372854534503158640859463",
                "143186487526600602876422947093322215088",
                "328058225501885616920193184072628328791",
                "220838548072331396540170405660788341714",
                "86093114899653646849847939295099643742",
                "16321493145204288021599138270464869939",
                "268159505939532242315037864165365095265",
                "71713936149488038724795886321397032354",
                "285498287126564949528857820266880433124",
                "66373925279464075902293594550674288959",
                "58263969253816316381248341878374462316",
                "122789675429872623490541574382763640575",
                "258158573389285423128068317054469240971"
            ]
        },
        "id": "CVE-2026-53698-426dcccf",
        "signature_type": "Line",
        "target": {
            "file": "core-war/src/main/java/org/silverpeas/web/servlets/FileServer.java"
        }
    },
    {
        "source": "https://github.com/silverpeas/silverpeas-core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec",
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "64321141061031274177427541979896835027",
            "length": 909.0
        },
        "id": "CVE-2026-53698-8672022c",
        "signature_type": "Function",
        "target": {
            "function": "getSilverpeasFile",
            "file": "core-war/src/main/java/org/silverpeas/web/servlets/FileServer.java"
        }
    },
    {
        "source": "https://github.com/silverpeas/silverpeas-core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec",
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "247891272350912906808260215783427417381",
            "length": 292.0
        },
        "id": "CVE-2026-53698-8e6a4960",
        "signature_type": "Function",
        "target": {
            "function": "isUserAllowed",
            "file": "core-war/src/main/java/org/silverpeas/web/servlets/FileServer.java"
        }
    },
    {
        "source": "https://github.com/silverpeas/silverpeas-core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec",
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "54323696137191686908410885665739190551",
            "length": 1243.0
        },
        "id": "CVE-2026-53698-924eb0de",
        "signature_type": "Function",
        "target": {
            "function": "doPost",
            "file": "core-war/src/main/java/org/silverpeas/web/servlets/FileServer.java"
        }
    },
    {
        "source": "https://github.com/silverpeas/silverpeas-core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec",
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "116603168596226113625653770773955553808",
            "length": 370.0
        },
        "id": "CVE-2026-53698-9b99af26",
        "signature_type": "Function",
        "target": {
            "function": "getMappedUrl",
            "file": "core-library/src/main/java/org/silverpeas/core/util/file/FileServerUtils.java"
        }
    },
    {
        "source": "https://github.com/silverpeas/silverpeas-core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec",
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "290580165080064097473301853471677008198",
            "length": 77.0
        },
        "id": "CVE-2026-53698-d6123ded",
        "signature_type": "Function",
        "target": {
            "function": "doGet",
            "file": "core-war/src/main/java/org/silverpeas/web/servlets/FileServer.java"
        }
    },
    {
        "source": "https://github.com/silverpeas/silverpeas-core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec",
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "135169978243549886399932627822732569479",
            "length": 335.0
        },
        "id": "CVE-2026-53698-dc7eada3",
        "signature_type": "Function",
        "target": {
            "function": "addStatistic",
            "file": "core-war/src/main/java/org/silverpeas/web/servlets/FileServer.java"
        }
    },
    {
        "source": "https://github.com/silverpeas/silverpeas-core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec",
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "276486735777807112922237082173914514237",
            "length": 357.0
        },
        "id": "CVE-2026-53698-e3a4098a",
        "signature_type": "Function",
        "target": {
            "function": "getAliasURL",
            "file": "core-library/src/main/java/org/silverpeas/core/util/file/FileServerUtils.java"
        }
    }
]
vanir_signatures_modified 
"2026-07-15T19:09:28Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53698.json"