plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection
Impact
The Classic portlet (plone.app.portlets.portlets.classic) used its user-supplied template/macro fields to build a TALES path expression that was then evaluated by the TAL path() helper. Because the value was interpreted as a full TALES expression, a user able to add or edit a Classic portlet could supply a crafted value that escapes simple path traversal and is evaluated as arbitrary code.
This is exploitable by any authenticated user who can configure a Classic portlet - which, with the default role map, includes regular users on their personal dashboard. The result is code execution in the context of the Plone process, i.e. a privilege escalation across the trust boundary between an authenticated web user and the server-side process.
Patches
The problem has been patched in plone.app.portlets
- For Plone 6.2, upgrade to
plone.app.portlets7.0.2. - For Plone 6.1, upgrade to
plone.app.portlets6.0.4. - For Plone 6.0, upgrade to
plone.app.portlets5.0.8.
Workarounds
If upgrading is not immediately possible:
- Restrict who can manage portlets: remove the
plone.app.portlets.ManageOwnPortletspermission from untrusted roles, and limit Manage portlets to trusted administrators (usually this is already restricted to the Manager and Site Administrator roles). - Where the Classic portlet is not needed, unregister it so it cannot be added. This would need to be done by editing a
portlets.xmlin your own code, so it is not a quick fix. - You could also effectively disable showing the classic portlet by customising its template. In the Zope Management Interface go to the
portal_view_customizationstool, locate theclassic.pttemplate and click it. Click the Customize button. Remove all text and replace it with<div>The classic portlet was disabled.</div>. (This is not a recommended way of customising a template, but in this case it is quite effective.)
Credits
Discovered by Giuseppe Caruso, and reported to the Plone/Zope Security Team. Thanks!
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | plone-app-portlets | >= 7.0.0, < 7.0.2, >= 6.0.0, < 6.0.4, >= 5.0.0, < 5.0.8 | 7.0.2, 6.0.4, 5.0.8 |
Referencias
- https://github.com/plone/plone.app.portlets/security/advisories/GHSA-rr49-f9g6-c9r5
- https://nvd.nist.gov/vuln/detail/CVE-2026-57149
- https://github.com/plone/plone.app.portlets/commit/1d9cacacfad9ed08b890dadc6e75741e295dc151
- https://github.com/plone/plone.app.portlets/commit/8a0641dc4054a2b13834bba00c67cd9a2fd189e1
- https://github.com/plone/plone.app.portlets/commit/fb979f01b57dd2fc06c90ee6577eb5eb285da8f1
- https://github.com/plone/plone.app.portlets
- https://github.com/plone/plone.app.portlets/releases/tag/5.0.8
- https://github.com/plone/plone.app.portlets/releases/tag/6.0.4
- https://github.com/plone/plone.app.portlets/releases/tag/7.0.2
- https://pypi.org/project/plone-app-portlets
- https://github.com/advisories/GHSA-rr49-f9g6-c9r5
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H- Debilidad (CWE)
CWE-95- Plataforma
- Python (PyPI)
- Paquete
plone-app-portlets- Publicada
- 23.09.2026
- Actualizado
- 11.10.2026 15:18
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-4138 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-rr49-f9g6-c9r5 - CC BY 4.0
Historial de vulnerabilidades: plone-app-portlets
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 2
- Primera → última
- 08.2026 09.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 2
Divulgaciones por año
- 2026: 2
-
plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.