Executive brief
Plone's Classic portlet component, used to display custom content on dashboard pages, contains a code injection vulnerability that allows authenticated users to execute arbitrary code on the server. An attacker with access to configure their own dashboard could exploit this to gain full control over the Plone application and compromise sensitive data.
Technical details
The Classic portlet in plone.app.portlets processes user-supplied template and macro field values by directly injecting them into TALES path expressions that are then evaluated by the TAL path() helper. This allows authenticated users to escape path traversal restrictions and inject arbitrary TALES expressions that execute as code within the Plone process context. Any authenticated user with default permissions (including regular users configuring their personal dashboard) can add or edit a Classic portlet to deliver the exploit. The vulnerability has been patched in versions 7.0.2 (Plone 6.2), 6.0.4 (Plone 6.1), and 5.0.8 (Plone 6.0).
Affected products
- Plone plone.app.portlets 7.0.1 and earlier (Plone 6.2), 6.0.3 and earlier (Plone 6.1), 5.0.7 and earlier (Plone 6.0)
Timeline
- 2026-09-23: disclosed: Security advisory published (GHSA-rr49-f9g6-c9r5)
- 2026-09-23: patched: Fixed in plone.app.portlets 7.0.2, 6.0.4, and 5.0.8