# CVE-2020-28736: PYSEC-2026-735 - Improper Restriction of XML External Entity Reference in Plone

Source: https://junglewise.ai/threats/cve-2020-28736-plone-xml-external-entity-injection-in-schema-editor  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-02. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2020-28736 · Severity: low · CVSS 3.1 · Published 2026-07-02

Plone is a web content management system. A flaw in the schema editor allows authenticated managers to upload malicious XML files that could read sensitive files from the server or perform other XML-based attacks. The vulnerability requires Manager-level privileges, limiting exposure but potentially allowing internal attackers to access confidential data.

Technologies: [Plone](https://junglewise.ai/threats/technologies/plone), [plone (PyPI)](https://junglewise.ai/threats/technologies/pypi-plone), [plone-app-theming (PyPI)](https://junglewise.ai/threats/technologies/plone-app-theming), [plone-supermodel (PyPI)](https://junglewise.ai/threats/technologies/plone-supermodel), [plone.app.dexterity (PyPI)](https://junglewise.ai/threats/technologies/plone-app-dexterity), [plone.app.event (PyPI)](https://junglewise.ai/threats/technologies/plone-app-event). Vendors: [Plone](https://junglewise.ai/threats/vendors/plone), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2020-28736 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-28736 being exploited in the wild.

**How severe is CVE-2020-28736?** Low severity, with a CVSS score of 3.1, published 2 July 2026.

**Which products and versions are affected?** Plone before 5.2.3; plone (PyPI) ECOSYSTEM:introduced=0,fixed=5.2.3; plone-app-theming (PyPI) ECOSYSTEM:introduced=0,fixed=4.1.6; plone-supermodel (PyPI) ECOSYSTEM:introduced=0,fixed=1.6.3; and 2 more.

**Is there a fix for CVE-2020-28736?** Yes. plone (PyPI): upgrade to 5.2.3 or later; plone-app-theming (PyPI): upgrade to 4.1.6 or later; plone-supermodel (PyPI): upgrade to 1.6.3 or later; plone.app.dexterity (PyPI): upgrade to 2.6.8 or later; plone.app.event (PyPI): upgrade to 3.2.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-28736 attacked?** It is attacked over the network.

**Am I affected by CVE-2020-28736?** Check whether you run Plone, plone (PyPI), plone-app-theming (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- plone (PyPI): upgrade to 5.2.3 or later

  ```sh
  pip install "plone>=5.2.3"
  ```

- plone-app-theming (PyPI): upgrade to 4.1.6 or later

  ```sh
  pip install "plone-app-theming>=4.1.6"
  ```

- plone-supermodel (PyPI): upgrade to 1.6.3 or later

  ```sh
  pip install "plone-supermodel>=1.6.3"
  ```

- plone.app.dexterity (PyPI): upgrade to 2.6.8 or later

  ```sh
  pip install "plone.app.dexterity>=2.6.8"
  ```

- plone.app.event (PyPI): upgrade to 3.2.10 or later

  ```sh
  pip install "plone.app.event>=3.2.10"
  ```


## Technical details

This is an XML External Entity (XXE) injection vulnerability in Plone's schema editor feature. The vulnerable component fails to properly restrict or disable XML external entity processing when parsing schema definition files. An authenticated user with Manager role can exploit this by submitting specially crafted XML that references external entities to read arbitrary files (information disclosure), perform SSRF attacks, or cause denial of service through billion laughs attacks. The vulnerability affects Plone versions before 5.2.3 and several related packages (plone-app-event before 3.2.10, plone-app-theming before 4.1.6, plone-app-dexterity before 2.6.8, and others). Patches are available in the fixed versions listed.

## Affected products

- Plone Plone before 5.2.3
- Plone plone-app-event before 3.2.10
- Plone plone-app-theming before 4.1.6
- Plone plone-app-dexterity before 2.6.8
- Plone plone-supermodel unknown

## Identifiers

- CVE-2020-28736
- GHSA-2c8c-84w2-j38j
- PYSEC-2020-248
- PYSEC-2026-2879
- PYSEC-2026-2882
- PYSEC-2026-2885
- PYSEC-2026-735

## Timeline

- 2020-12-30: disclosed: Vulnerability reported to NVD
- 2021-04-07: advisory: GitHub Security Advisory GHSA-2c8c-84w2-j38j published
- 2020-12: patched: Fixes available in Plone 5.2.3 and corresponding versions of affected packages

## References

- [https://github.com/plone/Products.CMFPlone/issues/3209](https://github.com/plone/Products.CMFPlone/issues/3209)

## Related threats

- [Plone plone.app.dexterity denial of service via excessive field length](https://junglewise.ai/threats/cve-2026-57576-plone-plone-app-dexterity-denial-of-service-via-excessive-field)
- [Plone plone.app.event denial of service in iCalendar import](https://junglewise.ai/threats/cve-2026-55247-plone-plone-app-event-denial-of-service-in-icalendar-import)
- [PYSEC-2026-2889 - Plone Privilege Escallation](https://junglewise.ai/threats/cve-2020-7938-plone-privilege-escallation)
- [PYSEC-2026-2964 - Plone unauthorized member addition vulnerability](https://junglewise.ai/threats/cve-2015-7315-plone-unauthorized-member-addition-vulnerability)
- [PYSEC-2026-2962 - Products.CMFPlone XSS in profile home_page property](https://junglewise.ai/threats/cve-2017-1000482-products-cmfplone-xss-in-profile-home-page-property)