Junglewise Threat Intelligence

CVE-2026-55248: Plone plone.app.portlets denial of service via RSS feed portlet

CVE-2026-55248 · Severity: critical · CVSS 9.1 · Published 2026-08-28

Executive brief

The RSS feed portlet in Plone allows users to add RSS feed sources to their site dashboard. An attacker with portlet management permissions can exploit this feature by pointing it to extremely large files or specially crafted feeds, causing the Plone server to consume excessive memory and become unavailable to legitimate users. Additionally, the vulnerability enables server-side request forgery (SSRF) attacks to probe internal networks and stored cross-site scripting (XSS) attacks through malicious feed content.

Technical details

The vulnerability exists in the RSS portlet component of plone.app.portlets, which fetches and parses RSS feeds from user-supplied URLs without adequate validation or resource limits. The issue involves three distinct attack vectors: (1) denial of service via uncontrolled resource consumption when fetching large files (CWE-400), (2) SSRF attacks by accepting URLs pointing to internal IP addresses and port numbers to probe internal services, and (3) stored XSS via malicious RSS feed items with JavaScript URLs. The vulnerability requires low privilege (a user with portlet management permissions) and no user interaction. Patches are available: upgrade to plone.app.portlets 7.0.2 (for Plone 6.2), 6.0.4 (for Plone 6.1), or 5.0.8 (for Plone 6.0). Fixes include stricter URL validation (only HTTP/HTTPS, rejecting internal IPs and port numbers) and a configurable maximum feed size limit (default 1 MB).

Affected products

  • Plone plone.app.portlets 7.0.0 to 7.0.1
  • Plone plone.app.portlets 6.0.0 to 6.0.3
  • Plone plone.app.portlets before 5.0.8

Timeline

  • 2026-06-23: disclosed: Published to repository advisory database
  • 2026-08-28: advisory: Published to GitHub Advisory Database
  • 2026-06-17: patched: Security fixes committed to repository

References