Executive brief
SSRF attacks via tracebacks in Plone
Affected products
- PyPI plone-supermodel
- PyPI plone-app-theming
- PyPI plone.app.dexterity
- PyPI plone.app.event
- PyPI plone
Junglewise Threat Intelligence
CVE-2020-28735: PYSEC-2026-737 - SSRF attacks via tracebacks in Plone
CVE-2020-28735 · Severity: low · CVSS 3.1 · Published 2026-07-02
Technologies: plone-supermodel (PyPI), plone-app-theming (PyPI), plone.app.dexterity (PyPI), plone.app.event (PyPI), plone (PyPI). Vendors: PyPI.
Related threats
- plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ic
- PYSEC-2026-2889 - Plone Privilege Escallation
- PYSEC-2026-2964 - Plone unauthorized member addition vulnerability
- PYSEC-2026-2962 - Products.CMFPlone XSS in profile home_page property
- PYSEC-2026-2963 - Products.CMFPlone Open Redirect Vulnerability