CVE-2026-78741: n/a

CVE-2026-78741 is a Cross Site Scripting (XSS) vulnerability affecting Silverpeas Core versions <=6.4.6. The flaw exists in the wysiwyg-CKEditor image upload feature, which does not properly sanitize user input, allowing attackers to inject and execute arbitrary scripts. This vulnerability could be exploited remotely without authentication but requires user interaction (UI:R). The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts confidentiality and integrity with no impact on availability.

Successful exploitation of this XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to information disclosure or manipulation of data. The impact is limited to confidentiality and integrity, with no direct impact on availability. There are no known exploits in the wild at this time.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with the wysiwyg-CKEditor image upload feature and consider applying any recommended workarounds from the vendor.