Remote Code Execution via TALES Injection in plone.app.portlets

The Classic portlet component (plone.app.portlets) within Plone is vulnerable to Remote Code Execution (RCE) via a TALES (Template Attribute Language Expression Syntax) injection flaw, tracked as CVE-2026-57149. The vulnerability exists because the component improperly treats user-supplied template or macro fields as part of a TALES path expression, which is then processed by the TAL path() helper.

An authenticated user with permissions to configure a Classic portlet can supply a crafted input that escapes basic path structures to execute arbitrary code within the server-side process. By default, regular users often possess the ability to add or edit portlets on their personal dashboards, significantly expanding the attack surface for internal privilege escalation. This vulnerability affects Plone 6.0, 6.1, and 6.2 versions via specific versions of the plone.app.portlets package.

Impact

Successful exploitation allows an authenticated user to achieve full code execution on the server hosting the Plone instance. This results in complete system compromise, unauthorized data access, and privilege escalation from a standard user to the security context of the Plone process, impacting the confidentiality, integrity, and availability of the affected Plone installation.

Recommendation

Prioritized actions for security and infrastructure teams:

• Upgrade the affected package to the patched versions immediately:
• For Plone 6.2: Upgrade to plone.app.portlets 7.0.2.
• For Plone 6.1: Upgrade to plone.app.portlets 6.0.4.
• For Plone 6.0: Upgrade to plone.app.portlets 5.0.8.
• If immediate patching is not feasible, restrict the plone.app.portlets.ManageOwnPortlets permission from untrusted roles to prevent exploitation attempts by standard users.
• Audit administrative logs for unauthorized modifications to Classic portlets as a hunt for potential exploitation attempts targeting CVE-2026-57149.