The vulnerability arises in Silverpeas’s handling of the Personal space servlet when the componentId parameter is omitted, allowing an attacker to craft a path that resolves to arbitrary files on the server. This path traversal flaw, identified as CWE‑36, can enable unauthorized reading of sensitive files and compromise confidentiality. No direct injection or remote code execution is described, but access to arbitrary file contents can lead to further exploitation such as credential theft or configuration disclosure.

Silverpeas version 6.4.6 and earlier are affected. The flaw exists in the Silverpeas core web application under the FileServer servlet, which serves user personal spaces. Upgrading to a supported release that contains the patch resolves the issue.

The CVSS score of 6.5 indicates a moderate severity risk. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The attack vector is likely remote via HTTP requests to the FileServer servlet, and authentication or proper parameter validation is required by the platform; thus the likelihood of exploitation depends on the exposure of the endpoint and the presence of user authentication. Given that the flaw does not require elevated privileges and can be triggered by manipulating the missing componentId, the risk is significant for exposed installations, especially if unrestricted personal space access is enabled.