CVE-2026-78741 identifies a Cross Site Scripting (XSS) vulnerability in Silverpeas Core software versions up to 6.4.6. The flaw exists specifically in the wysiwyg-CKEditor image upload feature, which improperly handles user input, allowing an attacker to inject malicious scripts. This vulnerability has been published but lacks a CVSS score and vendor remediation details. No known exploits have been reported in the wild.

Successful exploitation of this XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side attacks. However, no active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the image upload feature or applying any recommended workarounds from the vendor once published.