{"id":"CVE-2026-53698","aliases":["EUVD-2026-36068","GHSA-qv8h-rqr3-mph9"],"status":"published","title":"Silverpeas mishandles the \"Personal space\" feature that is selected when no componentId is set","description":"Silverpeas through 6.4.6 mishandles the \"Personal space\" feature that is selected when no componentId is set.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00327,"percentile":0.26048,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-36"],"published":"2026-06-10T00:00:00Z","modified":"2026-10-28T11:16:57Z","affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.silverpeas.core:silverpeas-core-war","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.4-feature13197"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.silverpeas.core:silverpeas-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.4-feature13197"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.silverpeas.core:silverpeas-core-war","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.4-feature13197"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.silverpeas.core:silverpeas-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.4-feature13197"}]}]}],"products":[{"vendor":"silverpeas","product":"silverpeas"}],"references":[{"url":"https://github.com/Silverpeas/Silverpeas-Core/commit/caa6e6d1ac967ebd29b39e11c2ef5e7fd0047eec","tags":["fix","web"]},{"url":"https://tracker.silverpeas.org/issues/15229","tags":["web"]},{"url":"https://github.com/Silverpeas/Silverpeas-Core/blob/983c5d07928b8a5ddcb39cc17d7fb9a0d87019b9/core-war/src/main/java/org/silverpeas/web/servlets/FileServer.java#L120-L122","tags":["web"]},{"url":"https://github.com/Silverpeas/Silverpeas-Core/blob/983c5d07928b8a5ddcb39cc17d7fb9a0d87019b9/core-war/src/main/java/org/silverpeas/web/servlets/FileServer.java#L150-L153","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53698","tags":["advisory"]},{"url":"https://github.com/Silverpeas/Silverpeas-Core/releases/tag/6.4.7","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qv8h-rqr3-mph9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53698.json","tags":["advisory"]},{"url":"https://github.com/Silverpeas/Silverpeas-Core","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-53698","description":"Silverpeas through 6.4.6 mishandles the \"Personal space\" feature that is selected when no componentId is set.","status":"published","published":"2026-06-10T00:00:00Z","modified":"2026-06-10T16:12:34.085Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-36"],"updated_at":"2026-11-02T14:20:00.11477Z"}],"euvd":[{"id":"EUVD-2026-36068","description":"Silverpeas through 6.4.6 mishandles the \"Personal space\" feature that is selected when no componentId is set.","status":"published","published":"2026-06-10T00:00:00Z","modified":"2026-06-10T16:12:34Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:45.405546Z"}],"ghsa":[{"id":"GHSA-qv8h-rqr3-mph9","title":"Silverpeas mishandles the \"Personal space\" feature that is selected when no componentId is set","description":"Silverpeas through 6.4.6 mishandles the \"Personal space\" feature that is selected when no componentId is set.","status":"published","published":"2026-06-10T18:31:46Z","modified":"2026-08-17T21:54:55Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-36"],"updated_at":"2026-11-02T14:41:01.23108Z"}],"nvd":[{"id":"CVE-2026-53698","description":"Silverpeas through 6.4.6 mishandles the \"Personal space\" feature that is selected when no componentId is set.","status":"published","published":"2026-06-10T16:17:17.24Z","modified":"2026-06-17T10:57:59.407Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-36"],"updated_at":"2026-11-02T14:12:23.485267Z"}],"osv":[{"id":"CVE-2026-53698","description":"Silverpeas through 6.4.6 mishandles the \"Personal space\" feature that is selected when no componentId is set.","status":"published","published":"2026-06-10T00:00:00Z","modified":"2026-10-28T11:16:57.329757916Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-36"],"updated_at":"2026-11-02T15:45:08.132336Z"},{"id":"GHSA-qv8h-rqr3-mph9","title":"Silverpeas mishandles the \"Personal space\" feature that is selected when no componentId is set","description":"Silverpeas through 6.4.6 mishandles the \"Personal space\" feature that is selected when no componentId is set.","status":"published","published":"2026-06-10T18:31:46Z","modified":"2026-08-17T22:11:01.708745Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-36"],"updated_at":"2026-11-02T15:46:55.122811Z"}]}}