plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection
### Impact The Classic portlet (plone.app.portlets.portlets.classic) used its user-supplied template/macro fields to build a TALES path expression that was then evaluated by the TAL path() helper. Because the value was interpreted as a full TALES expression, a user able to add or edit a Classic portlet could supply a crafted value that escapes simple path traversal and is evaluated as arbitrary code. This is exploitable by any authenticated user who can configure a Classic portlet - which, with the default role map, includes regular users on their personal dashboard. The result is code execution in the context of the Plone process, i.e. a privilege escalation across the trust boundary between an authenticated web user and the server-side process. ### Patches The problem has been patched in `plone.app.portlets` * For Plone 6.2, upgrade to `plone.app.portlets` 7.0.2. * For Plone 6.1, upgrade to `plone.app.portlets` 6.0.4. * For Plone 6.0, upgrade to `plone.app.portlets` 5.0.8. ### Workarounds If upgrading is not immediately possible: - Restrict who can manage portlets: remove the `plone.app.portlets.ManageOwnPortlets` permission from untrusted roles, and limit Manage portlets to trusted administrators (usually this is already restricted to the Manager and Site Administrator roles). - Where the Classic portlet is not needed, unregister it so it cannot be added. This would need to be done by editing a `portlets.xml` in your own code, so it is not a quick fix. - You could also eff
PYSEC-2026-4138
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:PYSEC-2026-4138
plone-app-portlets
Source reference: /affected/0/package/name
- Affected versions
- 5.0.0
Source reference:
/affected/0/versions5.0.1Source reference:
/affected/0/versions5.0.2Source reference:
/affected/0/versions5.0.3Source reference:
/affected/0/versions5.0.4Source reference:
/affected/0/versions5.0.5Source reference:
/affected/0/versions5.0.6Source reference:
/affected/0/versions5.0.7Source reference:
/affected/0/versions6.0.0Source reference:
/affected/0/versions6.0.1Source reference:
/affected/0/versions6.0.2Source reference:
/affected/0/versions6.0.3Source reference:
/affected/0/versions7.0.0Source reference:
/affected/0/versions7.0.1Source reference:
/affected/0/versions - Fixed versions
- 5.0.8
Source reference:
/affected/0/ranges6.0.4Source reference:
/affected/0/ranges7.0.2Source reference:
/affected/0/ranges5.0.8Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.0.8"
},
{
"introduced": "6.0.0"
},
{
"fixed": "6.0.4"
},
{
"introduced": "7.0.0"
},
{
"fixed": "7.0.2"
},
{
"introduced": "5.0.0"
},
{
"fixed": "5.0.8"
}
]
}
],
"package": {
"name": "plone-app-portlets",
"purl": "pkg:pypi/plone-app-portlets",
"ecosystem": "PyPI"
},
"versions": [
"5.0.0",
"5.0.1",
"5.0.2",
"5.0.3",
"5.0.4",
"5.0.5",
"5.0.6",
"5.0.7",
"6.0.0",
"6.0.1",
"6.0.2",
"6.0.3",
"7.0.0",
"7.0.1"
],
"database_specific": {
"source": "https://github.com/pypa/advisory-database/blob/main/vulns/plone-app-portlets/PYSEC-2026-4138.yaml"
}
}
]- Related CVEs
- CVE-2026-57149
Source reference:
/aliases
Publisher severity
No explicit severity was provided.
- Event
- #62510 · Revision 1
- Added to Heist Feed
- Publisher date