CVE-2026-55247

Name of the Vulnerable Software and Affected Versions plone.app.event versions prior to 5.2.4 plone.app.event versions prior to 6.0.1

Description The iCalendar import functionality in src/plone/app/event/ical/importer.py fails to sufficiently restrict calendar and event URLs, does not bound downloaded bytes or imported events, and commits work per event. A logged-in editor can exploit this to perform Server-Side Request Forgery (SSRF)—where the server is coerced into making requests to internal network resources or local files—exhaust system resources to take the site offline, or store a malicious event URL that executes scripts in another user's browser (Stored Cross-Site Scripting).

Recommendations Upgrade to version 5.2.4. Upgrade to version 6.0.1. Restrict the plone.app.event: Import Ical permission to the Manager role via the Security tab of the Zope Management Interface (manage access).