Plone plone.app.portlets up to 5.0.7/6.0.3/7.0.1 RSS Portlet rss.py server-side request forgery

Summaryinfo

A vulnerability identified as critical has been detected in Plone plone.app.portlets up to 5.0.7/6.0.3/7.0.1. The affected element is the function _rss_feed_url_validator/_normal_url_validator/RSSFeed._retrieveFeed/RSSFeed._buildItemDict of the file src/plone/app/portlets/portlets/rss.py of the component RSS Portlet. This manipulation causes server-side request forgery. This vulnerability appears as CVE-2026-55248. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in Plone plone.app.portlets up to 5.0.7/6.0.3/7.0.1. It has been declared as critical. Affected by this vulnerability is the function _rss_feed_url_validator/_normal_url_validator/RSSFeed._retrieveFeed/RSSFeed._buildItemDict of the file src/plone/app/portlets/portlets/rss.py of the component RSS Portlet. The manipulation with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portlets/rss.py to download and retain excessive data in memory and deny service. The same RSS URL handling accepts internal hosts, IP addresses, single-word domains, and explicit ports, allowing server-side requests that can probe internal network services and open ports. A malicious feed item can also supply a JavaScript URL that is retained as the item link and can execute script when used by a victim. The affected logic includes _rss_feed_url_validator, _normal_url_validator, RSSFeed._retrieveFeed, RSSFeed._buildItemDict, and the FEED_DATA in-memory cache. This issue is fixed in versions 5.0.8, 6.0.4, and 7.0.2.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-55248 since 06/16/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available.

Upgrading to version 5.0.8, 6.0.4 or 7.0.2 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Content Management System

Vendor

• Plone

Name

• plone.app.portlets

Version

• 5.0.0
• 5.0.1
• 5.0.2
• 5.0.3
• 5.0.4
• 5.0.5
• 5.0.6
• 5.0.7
• 6.0.0
• 6.0.1
• 6.0.2
• 6.0.3
• 7.0.0
• 7.0.1

License

• open-source

Website

• Product: https://github.com/plone/plone.app.portlets/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion