GHSA-8RQH-VXPR-X77P: Stored Cross-Site Scripting via MIME Type Spoofing in Plone REST API
Vulnerability ID: GHSA-8RQH-VXPR-X77P
CVSS Score: 4.3
Published: 2026-07-17
A stored Cross-Site Scripting (XSS) vulnerability exists within plone.restapi, the REST API package for Plone content management system. By supplying a spoofed input MIME type (text/x-html-safe), an attacker can mislead the rendering layer (plone.app.textfield) into assuming that the supplied content is already sanitized. This causes the system to skip the safe_html transform, allowing arbitrary JavaScript to execute in the victim's browser when they view the compromised page.
TL;DR
A stored XSS vulnerability exists in Plone's REST API and textfield components where attackers can bypass HTML sanitization by spoofing input MIME types as 'text/x-html-safe'. Upgrading plone.restapi and plone.app.textfield is required to mitigate this flaw.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-80 (Improper Neutralization of Script-Related HTML Tags)
- Attack Vector: Network (AV:N)
- CVSS v3.1 Score: 4.3 (Medium)
- Attack Complexity: Low (AC:L)
- Privileges Required: Low (PR:L)
- User Interaction: None (UI:N)
- Exploit Status: PoC (Proof of Concept Available)
Affected Systems
- Plone CMS
- plone.restapi
- plone.app.textfield
-
plone.restapi: < 9.15.6 (Fixed in:
9.15.6) -
plone.restapi: == 10.0.0 (Fixed in:
10.0.1) -
plone.app.textfield: < 2.0.2 (Fixed in:
2.0.2) -
plone.app.textfield: >= 3.0.0, < 3.0.2 (Fixed in:
3.0.2) -
plone.app.textfield: == 4.0.0 (Fixed in:
4.0.1)
Exploit Details
- GitHub Security Advisory (REST API Layer): Advisory documenting the REST API deserialization bypass mechanism and PoC inputs.
- GitHub Security Advisory (Textfield Layer): Advisory covering the underlying rendering bypass in the textfield library.
Mitigation Strategies
- Upgrade plone.restapi to 9.15.6 or 10.0.1 to block input spoofing via REST APIs.
- Upgrade plone.app.textfield to 2.0.2, 3.0.2, or 4.0.1 to force sanitization at the rendering layer.
- Inspect the ZODB database using a diagnostic script to clean up legacy spoofed fields.
- Implement WAF regex rules to block incoming payloads declaring 'text/x-html-safe'.
Remediation Steps:
- Identify the current installed versions of plone.restapi and plone.app.textfield in your buildout or pip constraints file.
- Update the package pins to the secure versions (e.g., plone.restapi>=9.15.6 and plone.app.textfield>=4.0.1).
- Run your buildout or deployment pipeline to fetch and apply the updated libraries.
- Run the Zope python shell client to execute the database cleanup script and sanitize legacy fields.
- Deploy Web Application Firewall (WAF) rule to block incoming request bodies containing 'text/x-html-safe'.
References
- GHSA-8rqh-vxpr-x77p (REST API Advisory)
- GHSA-4r4f-gg25-rmg5 (Underlying Library Advisory)
- Public GitHub Advisory Database Entry
Read the full report for GHSA-8RQH-VXPR-X77P on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)