CVE-2018-19586

Silverpeas 5.15 through 6.0.2 is affected by an authenticated Directory Traversal vulnerability that can be triggered during file uploads because core/webapi/upload/FileUploadData.java mishandles a StringUtil.java call. This vulnerability enables regular users to write arbitrary files on the underlying system with privileges of the user running the application. Especially, an attacker may leverage the vulnerability to write an executable JSP file in an exposed web directory to execute commands on the underlying system.

• CWE-22

• https://github.com/Silverpeas/Silverpeas-Core/blob/d8c3bbb0695a4907db013401bd16c6527e2b4f41/core-web/src/main/java/org/silverpeas/core/webapi/upload/FileUploadData.java#L89Patch, Third Party Advisory
• https://www.bishopfox.com/news/2019/01/silverpeas-5-15-to-6-0-2-path-traversal/Exploit, Third Party Advisory
• https://github.com/Silverpeas/Silverpeas-Core/blob/d8c3bbb0695a4907db013401bd16c6527e2b4f41/core-web/src/main/java/org/silverpeas/core/webapi/upload/FileUploadData.java#L89Patch, Third Party Advisory
• https://www.bishopfox.com/news/2019/01/silverpeas-5-15-to-6-0-2-path-traversal/Exploit, Third Party Advisory

Published

Apr 9, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-19580All versions of GitLab prior to 11.5.1, 11.4.8, and 11.3.11 …
• CVE-2018-19581GitLab EE, versions 8.3 up to 11.x before 11.3.11, 11.4 befo…
• CVE-2018-19582GitLab EE, versions 11.4 before 11.4.8 and 11.5 before 11.5.…
• CVE-2018-19583GitLab CE/EE, versions 8.0 up to 11.x before 11.3.11, 11.4 b…6.5
• CVE-2018-19584GitLab EE, versions 11.x before 11.3.11, 11.4 before 11.4.8,…
• CVE-2018-19585GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x…
• CVE-2018-19587In Cesanta Mongoose 6.13, a SIGSEGV exists in the mongoose.c…
• CVE-2018-19588Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Co…
• CVE-2018-19589Incorrect Access Controls of Security Officer (SO) in PKCS11…
• CVE-2018-1959IBM Security Identity Manager 7.0.1 Virtual Appliance contai…5.1
• CVE-2018-19591In the GNU C Library (aka glibc or libc6) through 2.28, atte…7.5
• CVE-2018-19592The "CLink4Service" service is installed with Corsair Link 4…7.8