Plone.app.portlets (< 5.0.8) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/plone.app.portlets--5.0.8/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 28 Aug 2026 21:13:28 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCritical Vulnerabilities in plone.app.portlets RSS Feed Portlethttps://feed.craftedsignal.io/briefs/2026-08-plone-rss-vulnerability/Fri, 28 Aug 2026 21:13:28 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-plone-rss-vulnerability/The plone.app.portlets package is vulnerable to denial of service, SSRF, and stored XSS via the RSS feed portlet feature, allowing authenticated users with portlet management permissions to exhaust memory, perform internal network reconnaissance, or inject malicious scripts.The Plone Security Team has identified critical security vulnerabilities (CVE-2026-55248) in the plone.app.portlets package. The vulnerabilities stem from the RSS feed portlet implementation. A user with permissions to manage portlets can provide an RSS feed URL pointing to a large file, causing significant memory consumption and leading to a denial of service (DoS). Furthermore, the lack of validation on the RSS URL allows an attacker to conduct server-side request forgery (SSRF) to probe internal network services and discover open ports. Additionally, the RSS feed parser is vulnerable to stored cross-site scripting (XSS) if a feed item contains a URL using the 'javascript:' protocol. These vulnerabilities impact Plone 6.2, 6.1, and 6.0 versions. Organizations should prioritize patching or implementing the recommended access restrictions for the portlet management feature.

Impact

Successful exploitation could result in service instability due to memory exhaustion, unauthorized exposure of internal network topology via SSRF, and potential account takeover or unauthorized actions through stored XSS. These issues affect any organization utilizing the RSS portlet feature within Plone environments.

Recommendation

  • Upgrade plone.app.portlets immediately to the patched versions: 7.0.2 for Plone 6.2, 6.0.4 for Plone 6.1, and 5.0.8 for Plone 6.0.
  • Revoke the plone.app.portlets.ManageOwnPortlets permission from untrusted roles to limit the attack surface.
  • Audit existing portlets to ensure no unauthorized RSS feeds are configured.
  • If the RSS portlet is not required, unregister it via portlets.xml configuration to mitigate the risk entirely.
]]>mediumadvisory