Plone vulnerabilities
We track 10 vulnerabilities in Plone products across 7 products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on September 22, 2026.
Latest Plone vulnerabilities
- 9.9 Critical severity
plone.app.portlets: Improper Neutralization of Directives in Dynamically Evaluated Code
plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of portlets that ship with Plone. Starting in version 5.0.0 and prior to versions 5.0.8, 6.0.4, and 7.0.2, the Classic portlet (plone.app.portlet
- 9.1 Critical severity
plone.app.portlets: Uncontrolled Resource Consumption
plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portlets/rss.py to
- 9.1 Critical severity
plone.app.event: Uncontrolled Resource Consumption
plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or
- 8.7 High severity
volto: NULL Pointer Dereference
Volto is a ReactJS-based frontend for the Plone Content Management System. Versions 16.34.0 and below, 17.0.0 through 17.22.1, 18.0.0 through 18.27.1, and 19.0.0-alpha.1 through 19.0.0-alpha.5, an anonymous user could cause the NodeJS server part of Volto to q
- 7.5 High severity
volto: Improper Handling of Exceptional Conditions
Volto is a React based frontend for the Plone Content Management System. In versions from 19.0.0-alpha.1 to before 19.0.0-alpha.4, 18.0.0 to before 18.24.0, 17.0.0 to before 17.22.1, and prior to 16.34.0, an anonymous user could cause the NodeJS server part of
- 7.5 High severity
Plone: Incorrect Default Permissions
Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request.
- 9.8 Critical severity
plone_docker_official_image: Uncontrolled Search Path Element
An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution due to a package listed in ++plone++static/components not existing in the public package index (npm).
- 7.1 High severity
Plone CMS: Improper Restriction of Rendered UI Layers or Frames
A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting verssion below 6.0.5. An attacker could store a malicious URL to be opened by an administrator and execute a malicios iframe element.
- 7.5 High severity
plone.rest: Allocation of Resources Without Limits or Throttling
plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingly
- 7.5 High severity
volto: Improper Authentication
Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could have their authentication cookie replaced with an authentication cookie from another user, effectively giving them contr