PT-2026-59516
Published
2026-07-09
·
Updated
2026-07-09
Description by
CVSS 3.1
8.8
HighMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role).
Exploitability
Fix
Vendors
Affected products
Related identifiers
Found an issue in the description? Have something to add? Feel free to write us 👾