Skip to content
Threat Feed
Subscribe

Product

Plone.app.portlets (>= 6.0.0, <= 6.0.3)

1 brief RSS
critical advisory

Remote Code Execution via TALES Injection in plone.app.portlets

Authenticated users can execute arbitrary code in the context of the Plone process by injecting malicious TALES expressions into Classic portlet configurations, exploitable via CVE-2026-57149.

plone.app.portlets +2 rce injection vulnerability web
1t 1c