CVE-2026-54503: plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.

Executive brief

A vulnerability in the Plone content management system's rich text handling allows for stored cross-site scripting (XSS). An attacker with basic posting privileges can bypass security filters by spoofing the content type of their input, potentially leading to the execution of malicious scripts in the browsers of other users. This could result in unauthorized access to user sessions or the theft of sensitive information displayed within the CMS.

Technical details

A stored XSS vulnerability exists in plone.app.textfield due to a logic error in RichTextValue.output. When the stored mimeType of a field matches the outputMimeType (specifically 'text/x-html-safe'), the system assumes the content is already sanitized and bypasses the safe_html transform. An attacker can exploit this via the REST API or by exploiting misconfigured field definitions to store unsanitized HTML containing malicious scripts. When the content is rendered using 'tal:content="structure ..."', the payload executes in the victim's browser. Patches are available in versions 2.0.2, 3.0.2, and 4.0.1.

Affected products

• Plone plone.app.textfield < 2.0.2, >= 3.0.0, < 3.0.2, 4.0.0

Timeline

• 2026-06-05: disclosed
• 2026-07-17: advisory

References

• https://api.github.com/users/gyst
• https://github.com/gyst
• https://api.github.com/users/gyst/gists%7B/gist_id%7D
• https://api.github.com/users/gyst/repos
• https://avatars.githubusercontent.com/u/122351?v=4
• https://api.github.com/users/gyst/events%7B/privacy%7D