PT-2026-54521
CVE-2026-57149
·
Published
2026-07-01
·
Updated
2026-10-01
Description by
CVSS 3.1
9.9
CriticalMetricsAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Plone versions 7.0.0 through 7.0.1
Plone versions 6.0.0 through 6.0.3
Plone versions 5.0.0 through 5.0.7
Description
A critical remote code execution (RCE) flaw allows TALES injection via the Classic portlet. TALES is a templating language used by Plone to render content. Additionally, the software is susceptible to denial of service (DoS) and server-side request forgery (SSRF).
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾