{"items":[{"id":"NVI-00014154","kind":"vulnerability","title":"plone.app.portlets vulnerable to denial of service via RSS feed portlet","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-x5g3-w747-2h8q","CVE-2026-55248"],"plain_summary":"GitHub lists this reviewed advisory for plone.app.portlets, plone.app.portlets, plone.app.portlets. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-50f385f069260f5f6fc0ae7f56ac7e0e"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-08-28T18:41:35.000Z","value":"9.1 critical","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-50f385f069260f5f6fc0ae7f56ac7e0e"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-50f385f069260f5f6fc0ae7f56ac7e0e","url":"https://github.com/advisories/GHSA-x5g3-w747-2h8q","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-x5g3-w747-2h8q","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T09:56:23.004Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-50f385f069260f5f6fc0ae7f56ac7e0e"],"technology":"plone.app.portlets","known_exclusions":[],"conditions_summary":"### Impact\nBy adding an RSS portlet, and giving this a link to a very large file, a member can cause a denial of service attack, because Plone will use lots of memory. The member could also use different urls to try to get information about the internal network and open port numbers (SSRF). A malicious RSS feed could cause stored XSS, when the url of a feed item is a javascript url.\n\n### Patches\nThe problem has been patched in `plone.app.portlets`.\n\n* For Plone 6.2: upgrade to `plone.app.portlets` 7.0.2\n* For Plone 6.1: upgrade to `plone.app.portlets` 6.0.4\n* For Plone 6.0: upgrade to `plone.app.portlets` 5.0.8\n\n### Workarounds\nIf upgrading is not immediately possible:\n\n- Restrict who can manage portlets: remove the `plone.app.portlets.ManageOwnPortlets` permission from untrusted roles, and limit Manage portlets to trusted administrators (usually this is already restricted to the Manager and Site Administrator roles).\n- Where the RSS portlet is not needed, unregister it so it cannot be added. This would need to be done by editing a `portlets.xml` in your own code, so it is not a quick fix.\n\n### References\n\nThis is similar to this [`plone.app.event` vulnerability](https://github.com","public_affected_ranges":[">= 7.0.0, <= 7.0.1"]},{"certainty":"source_listed","source_ids":["sr-50f385f069260f5f6fc0ae7f56ac7e0e"],"technology":"plone.app.portlets","known_exclusions":[],"conditions_summary":"### Impact\nBy adding an RSS portlet, and giving this a link to a very large file, a member can cause a denial of service attack, because Plone will use lots of memory. The member could also use different urls to try to get information about the internal network and open port numbers (SSRF). A malicious RSS feed could cause stored XSS, when the url of a feed item is a javascript url.\n\n### Patches\nThe problem has been patched in `plone.app.portlets`.\n\n* For Plone 6.2: upgrade to `plone.app.portlets` 7.0.2\n* For Plone 6.1: upgrade to `plone.app.portlets` 6.0.4\n* For Plone 6.0: upgrade to `plone.app.portlets` 5.0.8\n\n### Workarounds\nIf upgrading is not immediately possible:\n\n- Restrict who can manage portlets: remove the `plone.app.portlets.ManageOwnPortlets` permission from untrusted roles, and limit Manage portlets to trusted administrators (usually this is already restricted to the Manager and Site Administrator roles).\n- Where the RSS portlet is not needed, unregister it so it cannot be added. This would need to be done by editing a `portlets.xml` in your own code, so it is not a quick fix.\n\n### References\n\nThis is similar to this [`plone.app.event` vulnerability](https://github.com","public_affected_ranges":[">= 6.0.0, < 6.0.4"]},{"certainty":"source_listed","source_ids":["sr-50f385f069260f5f6fc0ae7f56ac7e0e"],"technology":"plone.app.portlets","known_exclusions":[],"conditions_summary":"### Impact\nBy adding an RSS portlet, and giving this a link to a very large file, a member can cause a denial of service attack, because Plone will use lots of memory. The member could also use different urls to try to get information about the internal network and open port numbers (SSRF). A malicious RSS feed could cause stored XSS, when the url of a feed item is a javascript url.\n\n### Patches\nThe problem has been patched in `plone.app.portlets`.\n\n* For Plone 6.2: upgrade to `plone.app.portlets` 7.0.2\n* For Plone 6.1: upgrade to `plone.app.portlets` 6.0.4\n* For Plone 6.0: upgrade to `plone.app.portlets` 5.0.8\n\n### Workarounds\nIf upgrading is not immediately possible:\n\n- Restrict who can manage portlets: remove the `plone.app.portlets.ManageOwnPortlets` permission from untrusted roles, and limit Manage portlets to trusted administrators (usually this is already restricted to the Manager and Site Administrator roles).\n- Where the RSS portlet is not needed, unregister it so it cannot be added. This would need to be done by editing a `portlets.xml` in your own code, so it is not a quick fix.\n\n### References\n\nThis is similar to this [`plone.app.event` vulnerability](https://github.com","public_affected_ranges":["< 5.0.8"]}],"null_published_at":"2026-11-02T10:00:37.214Z","source_updated_at":"2026-08-28T18:41:35.000Z","source_disclosed_at":"2026-08-28T18:41:35.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T09:56:23.004Z"}],"next_cursor":null,"snapshot_revision":"42594"}