Junglewise Threat Intelligence

CVE-2026-55247: Plone plone.app.event denial of service in iCalendar import

CVE-2026-55247 · Severity: critical · CVSS 9.1 · Published 2026-08-28

Executive brief

Plone's event management plugin (plone.app.event) contains vulnerabilities in its iCalendar import feature that allow logged-in editors to take the entire website offline by triggering resource exhaustion. Attackers can also exploit the feature to perform server-side request forgery (SSRF) attacks to read internal files, and to store malicious scripts in event URLs. This can result in site downtime, unauthorized access to internal resources, and account compromise of other users.

Technical details

The vulnerability comprises multiple flaws in the iCalendar import functionality: (1) uncontrolled resource consumption leading to denial of service via CWE-400, (2) server-side request forgery (SSRF) allowing access to internal network resources and local files, and (3) stored cross-site scripting (XSS) via the event URL field. The vulnerability requires low privileges (an authenticated editor role) and no user interaction. The root cause involves insufficient input validation and lack of resource limits on imported calendar data. The patch harddens URL validation, restricts the import size (default 100KB via MAXIMUM_ICAL_IMPORT_SIZE_BYTES), limits event count (default 53 via MAXIMUM_ICAL_IMPORT_EVENTS), adds timeout checks, and validates event URLs to exclude dangerous schemes (e.g., javascript:). Patches are available: plone.app.event 5.2.4 for Plone 6.0–6.1, and 6.0.1 for Plone 6.2.

Affected products

  • Plone plone.app.event < 5.2.4 and >= 6.0.0a1, < 6.0.1

Timeline

  • 2026-06-23: disclosed: Initially published to advisory database
  • 2026-08-28: advisory: GitHub Advisory Database publication
  • 2026-06-09: patched: Patch commit 1e3c83c for 5.2.x branch
  • 2026-06-11: patched: Patch commit 4de5eb3 for 6.0.x branch

References