Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
A GitHub-reviewed security advisory, not necessarily under active exploitation the way our CISA KEV advisories are, but a real, disclosed vulnerability in an open-source dependency.
Affected packages
Vulnerable: >= 7.0.0, <= 7.0.1
Patched in 7.0.2
Vulnerable: >= 6.0.0, <= 6.0.3
Patched in 6.0.4
Vulnerable: >= 5.0.0, <= 5.0.7
Patched in 5.0.8
Details
The Classic portlet (plone.app.portlets.portlets.classic) used its user-supplied template/macro fields to build a TALES path expression that was then evaluated by the TAL path() helper. Because the value was interpreted as a full TALES expression, a user able to add or edit a Classic portlet could supply a crafted value that escapes simple path traversal and is evaluated as arbitrary code.
This is exploitable by any authenticated user who can configure a Classic portlet - which, with the default role map, includes regular users on their personal dashboard. The result is code execution in the context of the Plone process, i.e. a privilege escalation across the trust boundary between an authenticated web user and the server-side process.
The problem has been patched in plone.app.portlets
plone.app.portlets 7.0.2.plone.app.portlets 6.0.4.plone.app.portlets 5.0.8.If upgrading is not immediately possible:
plone.app.portlets.ManageOwnPortlets permission from untrusted roles, and limit Manage portlets to trusted administrators (usually this is already restricted to the Manager and Site Administrator roles).portlets.xml in your own code, so it is not a quick fix.portal_view_customizations tool, locate the classic.pt template and click it. Click the Customize button. Remove all text and replace it with <div>The classic portlet was disabled.</div>. (This is not a recommended way of customising a template, but in this case it is quite effective.)Discovered by Giuseppe Caruso, and reported to the Plone/Zope Security Team. Thanks!
EPSS, exploit probability
Low0.64%
estimated chance of real-world exploitation in the next 30 days, higher than 50.8% of every CVE FIRST.org scores
Refreshed 11/8/2026, via FIRST.org's EPSS model, not CVSS, this measures likelihood of exploitation, not how severe it would be.
Talk to us about this
Find out whether this dependency (or others like it) is actually reachable in your codebase.
Get help patching, or building dependency-scanning into your pipeline going forward.
A secure code review or supply chain review finds this before an advisory does.