Critical Vulnerabilities in plone.app.event

The plone.app.event package, a component used within the Plone content management system, is affected by a series of vulnerabilities (CVE-2026-55247) originating in its iCalendar import functionality. The flaws allow a logged-in editor to conduct a denial-of-service attack, perform Server-Side Request Forgery (SSRF) to read internal network resources or local server files, and execute stored Cross-Site Scripting (XSS) via the event URL field. These vulnerabilities were responsibly reported and patched in versions 5.2.4 and 6.0.1. Due to the nature of the SSRF and DoS vectors, environments where untrusted users possess the 'Editor' role are at high risk of internal reconnaissance and service disruption. There is currently no known workaround for the stored XSS vulnerability.

Impact

Successful exploitation could result in total site unavailability, exfiltration of internal network or local file system data via SSRF, and persistent XSS injection. These vulnerabilities target the administrative and content creation workflows of Plone installations, putting any organization relying on Plone for public or internal content hosting at risk of data breach or operational outages.

Recommendation

• Prioritize upgrading plone.app.event to the patched versions: 6.0.1 for Plone 6.2 users, or 5.2.4 for Plone 6.0 and 6.1 users.
• Until patching is complete, restrict the "plone.app.event: Import Ical" permission exclusively to the "Manager" role within the Zope Management Interface (manage_access) to limit the attack surface to trusted administrators.
• Monitor webserver access logs for anomalous POST requests to calendar import endpoints or requests targeting internal network or local file paths.