Executive brief
Plone's content management system becomes unresponsive when users upload files or images with excessively long filenames. An authenticated attacker can craft a malicious upload to render the application slow or unusable, and subsequently make it difficult for legitimate administrators to edit or delete the compromised content. This can disrupt site operations and user experience.
Technical details
The vulnerability is an uncontrolled resource consumption issue (CWE-400) in plone.app.contenttypes affecting filename handling during file and image uploads. When a user with upload privileges (low privilege requirement) submits a file with a very long filename, the application fails to properly validate or constrain the filename length, consuming excessive resources and rendering the web interface unresponsive. An attacker can exploit this over the network without user interaction once authenticated. The vulnerability has been patched in versions 5.0.1 (Plone 6.2), 4.0.10 (Plone 6.1), and 3.0.12 (Plone 6.0). A related issue in plone.app.dexterity is addressed in a separate advisory.
Affected products
- Plone plone.app.contenttypes 5.0.0; 4.0.0 to 4.0.9; 3.0.0 to 3.0.11
Timeline
- 2026-06-23: disclosed
- 2026-06-23: patched: Patches released for plone.app.contenttypes 3.0.12, 4.0.10, and 5.0.1
- 2026-09-23: advisory