Skip to main content
  1. Posts/

[ RESEARCH ] - CVE-2026-78742 - Stored Cross Site Scripting (XSS) in introduction Multimedia library application (Silverpeas Core <=6.4.6)

·343 words·2 mins·
RESEARCH CVE-2026-78742 SILVERPEAS
Table of Contents

Summary
#

In the introduction of the Multimedia library application is vulnerable to Stored Cross-Site Scripting (XSS). When editing the introduction intercept the POST request, add the payload in the editor1 parameter to execute the payload once a user visits the Multimedia application.

General information
#

Description: The Multimedia library introduction of Silverpeas Core is vulnerable to Stored Cross-Site Scripting (XSS).
Versions Affected: <= 6.4.6
Version Fixed: 6.4.7
Researcher: HEKK.ONE

Proof-of-Concept (POC) Exploit
#

This exploit works when an authenticated user has a workspace available with the Multimedia library application and in the Managers role.

Multimedia library application
#

Login as the user that is member of a workspace with the Multimedia library application and in the Managers role, select the space and click on Create an album.

Enter for both fields random text and press Ok.

Hit refresh page (F5) and go to the library overview and select Edit introduction. In the shown editor, type some random text, turn on the intercept proxy (ex. CAIDO) and click on Save and exit. The intercepted POST request is to: POST /silverpeas/wysiwyg/jsp/htmlEditor.jsp HTTP/1.1, edit the data as follows with the URL encoded JavaScript payload: editor1=%3Cimg%20src%3Dx%20onerror%3Dprompt(1)%3B%3E&actionWysiwyg=SaveHtmlAndExit&origin=gallery28&X-STKN=ZmVlOTIwMDMtZGQ5YS00ODQ5LWI0ZTMtMDRiZTJkZjk2YzM3 and forward the request.

The JavaScript is executed every time some user visits the library overview.

If the Multimedia library application is not available install it using below.

Create workspace and add application
#

Login as an administrator and click on the menu item Back office. Within the backoffice select Workspace & applications and Create a space.

Fill in a random name for the workspace and click OK. To the right on the screen, select within the dropdown menu Add an application and select Content Management / Multimedia library, give the application a name (ex. mmlibrary) and select OK.

Once the application is created, add a user to one of the following roles (Managers/Publishers/Contributors/Reader with priviledge or Readers) by clicking on the tab, and selecting Edit to add a user in a specific role.

Once a user is added to the application in the created space, login as that user.

Related

[ RESEARCH ] - CVE-2026-78738 - Stored XSS Silverpeas Core 6.4.6 - File upload feature
·384 words·2 mins
RESEARCH CVE-2026-78738 SILVERPEAS
Stored XSS in Silverpeas Document Management. By modifying the X-FULL-PATH header during file upload with an XSS payload, the payload executes when the file’s preview button is clicked.
[ RESEARCH ] - CVE-2026-78741 - Stored XSS in wysiwyg-CKEditor image upload feature (Silverpeas <= 6.4.6)
·235 words·2 mins
RESEARCH CVE-2026-78741 SILVERPEAS
Stored XSS in Silverpeas’ CKEditor image upload feature allows attackers to replace the filename with a JavaScript payload that executes after the file is uploaded.
[ RESEARCH ] - CVE overview
·88 words·1 min
RESEARCH CVE OVERVIEW
Overview of analyzed applications and discovered Common Vulnerabilities and Exposures (CVE)
OFFSEC - Proving Grounds - FLINK
·1835 words·9 mins
OFFSEC PG PRACTICE APACHE FLINK MSFCONSOLE PACK2THEROOT CVE-2026-41651
Apache Flink 2.0.0 on port 8081 is exploited via Metasploit’s JAR Upload RCE module for initial access. LinPEAS identifies Pack2TheRoot (CVE-2026-41651), enabling privilege escalation to root.
OFFSEC - Proving Grounds - CARRYOVER
·3043 words·15 mins
OFFSEC PG PRACTICE SQLMAP LD_PRELOAD
Carvilla on port 80 is vulnerable to SQL injection, providing initial access via SQLmap. An exposed LD_PRELOAD variable enables a custom shared object to be executed with sudo, escalating privileges to root.
OFFSEC - Proving Grounds - ZAB
·1473 words·7 mins
OFFSEC PG PRACTICE MAGE PACK2THEROOT CVE-2026-41651
Gobuster finds local.txt on port 80. A Mage web app on port 6789 provides browser-based terminal access. The server is vulnerable to Pack2TheRoot (CVE-2026-41651), enabling privilege escalation to root.