Products.isurlinportal has possible open redirect when using more than 2 forward slashes
Impact
A url /login?came_from=////evil.example may redirect to an external website after login.
Standard Plone is not affected, but if you have customised the login, for example with add-ons, you might be affected. You can try the url to check if you are affected or not.
Patches
The problem has been patched in Products.isurlinportal.
- Plone 6.2: upgrade to
Products.isurlinportal4.0.0. - Plone 6.1: upgrade to
Products.isurlinportal3.1.0. - Plone 6.0: upgrade to
Products.isurlinportal2.1.0. - Older Plone versions don't have security support anymore.
Workarounds
There are no known workarounds.
Background
When you are anonymous and land on a page that requires a login, Plone sends you to the login form. After successful login, Plone redirects you back to the page you came from. Various other forms and pages have a similar system.
This could get abused by an attacker to trick Plone into redirecting to a different website. Plone checks the page that would be redirected to. It is only accepted if it is within the Plone site domain or part of a different trusted domain.
The main check for this is in the Products.isurlinportal package. A lot of potentially malicious urls are already safely rejected, but here a loop hole was found.
This was discovered during a penetration test by the CERT-EU Team.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | products-isurlinportal | >= 4.0.0a1, < 4.0.0, >= 3.0.0, < 3.1.0, < 2.1.0, < 2.1.0, >= 3.0.0, < 3.1.0 | 4.0.0, 3.1.0, 2.1.0 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N- Weakness (CWE)
CWE-601- Platform
- Python (PyPI)
- Package
products-isurlinportal- Disclosed
- 02.03.2026
- Updated
- 11.10.2026 12:19
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-112 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-43gx-6gv6-3jcp - CC BY 4.0
Vulnerability history: products-isurlinportal
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 08.2021 03.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Medium 1
Disclosures per year
- 2021: 1
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 1
-
Products.isurlinportal has possible open redirect when using more than 2 forward slashes this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.