{"id":"CVE-2026-53698","details":"Silverpeas through 6.4.6 mishandles the \"Personal space\" feature that is selected when no componentId is set.","modified":"2026-07-15T19:09:28.389525Z","published":"2026-06-10T00:00:00Z","database_specific":{"cna_assigner":"mitre","cwe_ids":["CWE-36"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53698.json"},"references":[{"type":"WEB","url":"https://github.com/Silverpeas/Silverpeas-Core/blob/983c5d07928b8a5ddcb39cc17d7fb9a0d87019b9/core-war/src/main/java/org/silverpeas/web/servlets/FileServer.java#L120-L122"},{"type":"WEB","url":"https://github.com/Silverpeas/Silverpeas-Core/blob/983c5d07928b8a5ddcb39cc17d7fb9a0d87019b9/core-war/src/main/java/org/silverpeas/web/servlets/FileServer.java#L150-L153"},{"type":"WEB","url":"https://tracker.silverpeas.org/issues/15229"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53698.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53698"},{"type":"FIX","url":"https://github.com/Silverpeas/Silverpeas-Core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/silverpeas/silverpeas-core","events":[{"introduced":"0"},{"fixed":"5015c59db6d4863ca049274910c1b8d471cba035"},{"fixed":"caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"6.4.6"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["6.4","6.0-rc3","6.0-rc2","6.0-rc1","6.0-beta1","6.0-alpha3","6.0-alpha2","6.0-alpha1","core-5.12","core-5.11","core-5.7","core-5.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53698.json","vanir_signatures_modified":"2026-07-15T19:09:28Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"79030508359798464903502427324191722982","length":419},"id":"CVE-2026-53698-0ba4d7c2","signature_type":"Function","signature_version":"v1","source":"https://github.com/silverpeas/silverpeas-core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec","target":{"file":"core-library/src/main/java/org/silverpeas/core/util/file/FileServerUtils.java","function":"getWebUrl"}},{"digest":{"function_hash":"60507207838188134108887599321006013365","length":154},"id":"CVE-2026-53698-17ef51cb","signature_type":"Function","signature_version":"v1","source":"https://github.com/silverpeas/silverpeas-core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec","target":{"file":"core-library/src/main/java/org/silverpeas/core/util/file/FileServerUtils.java","function":"getUrl"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"103959518776543354182857808214429403432","length":211},"id":"CVE-2026-53698-2e255295","signature_type":"Function","signature_version":"v1","source":"https://github.com/silverpeas/silverpeas-core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec","target":{"file":"core-library/src/main/java/org/silverpeas/core/util/file/FileServerUtils.java","function":"replaceSpecialChars"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/silverpeas/silverpeas-core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec","target":{"file":"core-library/src/main/java/org/silverpeas/core/util/file/FileServerUtils.java"},"deprecated":false,"digest":{"line_hashes":["100363168111302556233559315981732492696","255303660874485888163795800186947113612","37949352185916795404641336836796312818","93263417965464359197486345174803466624","22024254149566286342687843728063641767","303569501222285029689873162610473825378","100043911649687559094879956939092136750","69046029111189559958028064258343811529","72653924797438131351007506883017554472","27512051165859122698803903004367067181","159129331030756066273437937784943616349","70818191559154728435609531537332011296","250746076416336812398932559825346747419","45398460648864238571608684870859371361","73242929178989631286517375010254703658","161543288961369849127944667229332233457","96051715838888015470273468403987769821","240287142142270631577275565726481748824","73099139414397787394557148257542991053","7335174453929712784579036709700644931","170483687570309549687816889579415831237","156855081846124392724450593600510225569","219919410801822481886583635671131411008","31995156520915832660680202805129711185","29928611079515149601242732175801602029","163699986284789630052813536488044928056","297585142361818224648169981611547282239","187306352820567281037074424296836747840","131835316430615035097278814590580479514","200860424080533681483216092901393366340","218118084182732659655863692378294631346","69534245749150303698216188283706755388","126445237262752942947671815617160987318","92021843187781666428024518181780730673","18105916148105666997386716841988115661","87280739621783329490309769116912408409","7893668278015331997646298771617645143","62433359163174405769287443366939793639","51759598343827125652214896833615493256","286673522671239023726434498755097928018","210441892750691857234433249958927003720","199260408368454026835430642955896386304","139673720824107218241572515937036742101","148654265645561295947616372168557505908","56317943182646446120973705059867122762","188557416506954109951192042812782492359","9928575302024141612433497869107041931","230474797618239299858474872169655945066","321400104279158422734117253822040940925","288772619417003069310445041473280426476","49110425656591845870378615352312674021","215862216384287576708464729435591303692","113978261414602261676088928717398053282","51529347279107637153617018475952327541","6717229848453940673278249606359505465","295055383711623111038296574244487918223","296027403665436870816310967847243553941","327410215960903776014557488846188246123","328689153498589269810201896079156227119","96488657985241541016804787306136632156","15764859444746653072824174366516064082","74164348373044007154863836166619017696","79291255971328937696363940890005053223","165623185373362484579311402487163422445","306162522505077023407768996947906882751","289561967439733700431250953862904212853","171613487209608143055539541311289757170","39258995790897037796791469616399115654"],"threshold":0.9},"id":"CVE-2026-53698-41d2cca5"},{"digest":{"threshold":0.9,"line_hashes":["22298557384674626337430403900388439606","86276038461003395107789716898782802304","185963825275918152913686580045941209574","334767068807449834073027991414172195872","83451024782128675001482293197245299851","34390105922193855559934233059918338168","70202618807695699591255824846108104701","242977127993699333569209593331239458460","77147669263292212399935270744860246160","53659358289440835732617997266952381717","331099601135517378291928172960982714453","251886811907812039097371445917760871966","236213808377414567136691630996249446018","188797031974429797367104523813233296936","139915535198074601445198214635547441278","339127948264338413643494520471713595560","131445968662890322321028856333298482518","118938741235220223899015203029088740791","89680362497448579955099806572853726612","36344526257924172554421058501083293552","290877549843406602493177262395677841337","22728712514597732565747671920319880962","258212385164214493106972013363753578874","248690581750133348485314670136082358094","175209949223472089358564734715592974197","280838924812087745805988814619299845834","336030481506597511042816563132827167096","94936042600069601698037361875173941588","118749176220998787231126492215457480297","12461167636314524779050210333221862742","57059963297428660362666991359901551999","261037881842967918228774600487372739313","49115866441935950476035139375737512604","98790867228284376050946502364831493991","24875213328874455189595192605416340890","214855689944041615036960533888158491731","47228892332103418463603042350517850614","217200187383189955930865022293065318655","23016145200387104830708570624219329103","114158513912645591198418993382368283908","105797006917840393756235247077950674027","165221616713216315575788918913345784355","279201473389465798138888706853798588063","331177456748576129708741962132618009110","287572911631567041607129507240397449471","99963301191921613945657783777150352685","310494223632030144750868633063004130440","164937912537636379158769386988291561021","181431536666240915536143704077235634789","303946395405040517130268594234660990320","14642583323770956418364568757704553914","211935997516064167288367917426879196741","143940646718233896595209187075210163153","49817578127786355847757842205945773965","240234359179064131709865738250362290674","166333988608432004809453512286633795297","100787064249212975483723250640225662504","137509627024348917860094998710330983466","65382436048396380575575006743357430972","167314860043563994339704852723429722145","171901750483038779755173045691162414781","291382816173037441906172068002578999450","44901610104233996941589165932646614096","277935427943164608329648629413684683848","173670997614690500691934089342253572174","205034692502276213580247833738151929582","306400937910760498252484563922191993936","85067644903380705128409088534547423098","207196410369505713227617683488497198463","39847644429004506501445090564973538389","252720978267275014408744655130340042921","22679121357113504948205570994058934237","171476371266132101721923603443625105108","94355586617269231179150889240803370409","250139177097818223298054523435766594649","81376386098025475452856842491105047722","2424995556949976359114728041434950321","96206780019320486641317307563381844093","209437581212264849681871748690716383832","312467634592847372854534503158640859463","143186487526600602876422947093322215088","328058225501885616920193184072628328791","220838548072331396540170405660788341714","86093114899653646849847939295099643742","16321493145204288021599138270464869939","268159505939532242315037864165365095265","71713936149488038724795886321397032354","285498287126564949528857820266880433124","66373925279464075902293594550674288959","58263969253816316381248341878374462316","122789675429872623490541574382763640575","258158573389285423128068317054469240971"]},"id":"CVE-2026-53698-426dcccf","signature_type":"Line","signature_version":"v1","source":"https://github.com/silverpeas/silverpeas-core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec","target":{"file":"core-war/src/main/java/org/silverpeas/web/servlets/FileServer.java"},"deprecated":false},{"id":"CVE-2026-53698-8672022c","signature_type":"Function","signature_version":"v1","source":"https://github.com/silverpeas/silverpeas-core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec","target":{"function":"getSilverpeasFile","file":"core-war/src/main/java/org/silverpeas/web/servlets/FileServer.java"},"deprecated":false,"digest":{"function_hash":"64321141061031274177427541979896835027","length":909}},{"target":{"file":"core-war/src/main/java/org/silverpeas/web/servlets/FileServer.java","function":"isUserAllowed"},"deprecated":false,"digest":{"function_hash":"247891272350912906808260215783427417381","length":292},"id":"CVE-2026-53698-8e6a4960","signature_type":"Function","signature_version":"v1","source":"https://github.com/silverpeas/silverpeas-core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec"},{"id":"CVE-2026-53698-924eb0de","signature_type":"Function","signature_version":"v1","source":"https://github.com/silverpeas/silverpeas-core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec","target":{"file":"core-war/src/main/java/org/silverpeas/web/servlets/FileServer.java","function":"doPost"},"deprecated":false,"digest":{"function_hash":"54323696137191686908410885665739190551","length":1243}},{"digest":{"function_hash":"116603168596226113625653770773955553808","length":370},"id":"CVE-2026-53698-9b99af26","signature_type":"Function","signature_version":"v1","source":"https://github.com/silverpeas/silverpeas-core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec","target":{"file":"core-library/src/main/java/org/silverpeas/core/util/file/FileServerUtils.java","function":"getMappedUrl"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/silverpeas/silverpeas-core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec","target":{"file":"core-war/src/main/java/org/silverpeas/web/servlets/FileServer.java","function":"doGet"},"deprecated":false,"digest":{"length":77,"function_hash":"290580165080064097473301853471677008198"},"id":"CVE-2026-53698-d6123ded"},{"deprecated":false,"digest":{"function_hash":"135169978243549886399932627822732569479","length":335},"id":"CVE-2026-53698-dc7eada3","signature_type":"Function","signature_version":"v1","source":"https://github.com/silverpeas/silverpeas-core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec","target":{"file":"core-war/src/main/java/org/silverpeas/web/servlets/FileServer.java","function":"addStatistic"}},{"source":"https://github.com/silverpeas/silverpeas-core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec","target":{"file":"core-library/src/main/java/org/silverpeas/core/util/file/FileServerUtils.java","function":"getAliasURL"},"deprecated":false,"digest":{"length":357,"function_hash":"276486735777807112922237082173914514237"},"id":"CVE-2026-53698-e3a4098a","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}]}