Silverpeas 5.15 through 6.0.2 is affected by an authenticated Directory Traversal vulnerability that can be triggered during file uploads be

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• silverpeas silverpeas5.15 and later · up to 6.0.2 inclusive

Other highest-scoring records for the same primary product.

• CVE-2024-42850An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements.
  39Monitor
• CVE-2024-36042Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthentic
  39Monitor
• CVE-2023-47326Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) via the Domain SQL Create function.
  35Monitor
• CVE-2023-47322The "userModify" feature of Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to privilege escalation.
  35Monitor
• CVE-2023-47320Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control.
  32Monitor
• CVE-2024-48814SQL Injection vulnerability in Silverpeas 6.4.1 allows a remote attacker to obtain sensitive information via the ViewType parameter of the f
  30Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A user-supplied file name is joined with the allowed directory, but the result is never checked to confirm it is still inside that directory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const file = path.join(ROOT, req.query.name);2res.sendFile(file);

1const file = path.resolve(ROOT, req.query.name);2if (!file.startsWith(ROOT + path.sep)) {3  return res.sendStatus(400);4}5res.sendFile(file);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.