GHSA-vmj7-7xmm-4349

Silverpeas Core has a reflected cross-site scripting vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-30139

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.silverpeas.core:silverpeas-core-war	<= 6.4-feature13197	no fix listed
Maven	org.silverpeas.core:silverpeas-core-web	<= 6.4-feature13197	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A reflected cross-site scripting (XSS) vulnerability in the AdvancedSearch functionality of Silverpeas Core allows attackers to execute arbitrary JavaScript in the context of a user's browser via crafted input.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-30139 advisory
https://github.com/Silverpeas/Silverpeas-Core/pull/1421 web
https://github.com/Silverpeas/Silverpeas-Core/commit/7b4bacc80d11ab60423bdc6eb69e0176e9c27fc7 web
https://github.com/Silverpeas/Silverpeas-Core package
https://github.com/bodd1593/CVEs-huyle/tree/main/CVE-2026-30139 web