DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-55247: CVE-2026-55247: Multiple Vulnerabilities (DoS, SSRF, and Stored XSS) in plone.app.event iCalendar Import

#security #cve #cybersecurity

CVE-2026-55247: Multiple Vulnerabilities (DoS, SSRF, and Stored XSS) in plone.app.event iCalendar Import

Vulnerability ID: CVE-2026-55247
CVSS Score: 9.1
Published: 2026-08-28

A critical security vulnerability exists in plone.app.event, the event content type package for the Plone CMS. Prior to versions 5.2.4 and 6.0.1, the iCalendar import component lacked proper file size controls, URL scheme validation, and network isolation filters. Authenticated editors could exploit these deficiencies to cause denial of service via memory exhaustion, read local files, perform server-side request forgery, and inject stored cross-site scripting vectors.

TL;DR

Plone's event importer failed to validate input sizes and URL protocols, enabling authenticated users to trigger Denial of Service, execute Server-Side Request Forgery, and inject Stored XSS.

Technical Details

  • CWE ID: CWE-400 (Uncontrolled Resource Consumption)
  • Attack Vector: Network
  • CVSS Score: 9.1 (Critical)
  • Impact: Denial of Service, SSRF, Stored XSS
  • Exploit Status: None
  • KEV Status: Not Listed
  • Access Required: Low Privilege (Authenticated Editor)

Affected Systems

  • Plone CMS (via plone.app.event)
  • plone.app.event: < 5.2.4 (Fixed in: 5.2.4)
  • plone.app.event: >= 6.0.0, < 6.0.1 (Fixed in: 6.0.1)

Code Analysis

Commit: 1e3c83c

Harden iCalendar import validation and resource limits

Commit: 4de5eb3

Strict validation on event URLs and protocol restrictions

Mitigation Strategies

  • Update plone.app.event to patched versions (5.2.4 or 6.0.1)
  • Restrict event creation and import privileges to highly trusted users
  • Configure system-level network firewalls to block outgoing traffic from the Plone application to local and private IP spaces
  • Implement a reverse proxy or WAF to filter malicious request patterns

Remediation Steps:

  1. Identify current installed version of plone.app.event using buildout or pip.
  2. Update requirements file to specify plone.app.event>=5.2.4 for Plone 5.x, or plone.app.event>=6.0.1 for Plone 6.x.
  3. Run the buildout or pip installation command to fetch and install the updated package.
  4. Restart the Plone/Zope instances to apply changes in a staging environment.
  5. Verify functionality by attempting to import a normal iCalendar file and ensuring unauthorized protocols are rejected.
  6. Deploy the updated build to production environments.

References

Read the full report for CVE-2026-55247 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)