CVE-2026-55248

Name of the Vulnerable Software and Affected Versions plone.app.portlets versions prior to 5.0.8 plone.app.portlets versions prior to 6.0.4 plone.app.portlets versions prior to 7.0.2

Description A member with permissions to add an RSS portlet can trigger a denial of service by setting the feed URL to a source with a very large response, causing the system to download and retain excessive data in memory. The RSS URL handling allows internal hosts, IP addresses, single-word domains, and explicit ports, enabling server-side requests to probe internal network services and open ports. Additionally, a malicious feed item can include a JavaScript URL that, when used by a victim, leads to stored Cross-Site Scripting (XSS), where a script is executed in the victim's browser. The affected logic involves the rss feed url validator function, normal url validator function, RSSFeed. retrieveFeed function, RSSFeed. buildItemDict function, and the FEED DATA in-memory cache.

Recommendations Upgrade to version 5.0.8. Upgrade to version 6.0.4. Upgrade to version 7.0.2. Remove the plone.app.portlets.ManageOwnPortlets permission from untrusted roles and limit portlet management to trusted administrators. Unregister the RSS portlet to prevent it from being added.