CVE-2026-55247: Plone plone.app.event denial of service in iCalendar import

CVE-2026-55247 · Severity: critical · CVSS 9.1 · Published 2026-08-28

Plone's event management plugin (plone.app.event) contains vulnerabilities in its iCalendar import feature that allow logged-in editors to take the entire website offline by triggering resource exhaustion. Attackers can also exploit the feature to perform server-side request forgery (SSRF) attacks to read internal files, and to store malicious scripts in event URLs. This can result in site downtime, unauthorized access to internal resources, and account compromise of other users.

Technologies: plone.app.event (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-55247 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55247 being exploited in the wild.
How severe is CVE-2026-55247?
Critical severity, with a CVSS score of 9.1, published 28 August 2026.
Which products and versions are affected?
plone.app.event (PyPI) ECOSYSTEM:introduced=0,fixed=5.2.4, ECOSYSTEM:introduced=0,fixed=5.2.4,introduced=6.0.0a1,fixed=6.0.1.
Is there a fix for CVE-2026-55247?
Yes. plone.app.event (PyPI): upgrade to 5.2.4, 6.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55247 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-55247?
Check whether you run plone.app.event (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • plone.app.event (PyPI): upgrade to 5.2.4, 6.0.1 or later
    pip install "plone.app.event>=6.0.1"

Technical details

The vulnerability comprises multiple flaws in the iCalendar import functionality: (1) uncontrolled resource consumption leading to denial of service via CWE-400, (2) server-side request forgery (SSRF) allowing access to internal network resources and local files, and (3) stored cross-site scripting (XSS) via the event URL field. The vulnerability requires low privileges (an authenticated editor role) and no user interaction. The root cause involves insufficient input validation and lack of resource limits on imported calendar data. The patch harddens URL validation, restricts the import size (default 100KB via MAXIMUM_ICAL_IMPORT_SIZE_BYTES), limits event count (default 53 via MAXIMUM_ICAL_IMPORT_EVENTS), adds timeout checks, and validates event URLs to exclude dangerous schemes (e.g., javascript:). Patches are available: plone.app.event 5.2.4 for Plone 6.0–6.1, and 6.0.1 for Plone 6.2.

Affected products

  • Plone plone.app.event < 5.2.4 and >= 6.0.0a1, < 6.0.1

Identifiers

  • CVE-2026-55247
  • GHSA-r82h-mqw3-fc56
  • PYSEC-2026-3883

Timeline

  • 2026-06-23: disclosed: Initially published to advisory database
  • 2026-08-28: advisory: GitHub Advisory Database publication
  • 2026-06-09: patched: Patch commit 1e3c83c for 5.2.x branch
  • 2026-06-11: patched: Patch commit 4de5eb3 for 6.0.x branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.