Executive brief
Improper Restriction of XML External Entity Reference in Plone
Affected products
- PyPI plone-app-theming
- PyPI plone-supermodel
- PyPI plone
- PyPI plone.app.dexterity
- PyPI plone.app.event
Junglewise Threat Intelligence
CVE-2020-28734: PYSEC-2026-736 - Improper Restriction of XML External Entity Reference in Plone
CVE-2020-28734 · Severity: low · CVSS 3.1 · Published 2026-07-02
Technologies: plone-app-theming (PyPI), plone-supermodel (PyPI), plone (PyPI), plone.app.dexterity (PyPI), plone.app.event (PyPI). Vendors: PyPI.
Related threats
- plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ic
- PYSEC-2026-2889 - Plone Privilege Escallation
- PYSEC-2026-2964 - Plone unauthorized member addition vulnerability
- PYSEC-2026-2962 - Products.CMFPlone XSS in profile home_page property
- PYSEC-2026-2963 - Products.CMFPlone Open Redirect Vulnerability