GHSA-43gx-6gv6-3jcp

Source

https://github.com/advisories/GHSA-43gx-6gv6-3jcp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-43gx-6gv6-3jcp/GHSA-43gx-6gv6-3jcp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-43gx-6gv6-3jcp

Aliases

Published

2026-03-02T20:14:23Z

Modified

2026-06-08T18:45:17Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Products.isurlinportal has possible open redirect when using more than 2 forward slashes

Details

Impact

A url /login?came_from=////evil.example may redirect to an external website after login.

Standard Plone is not affected, but if you have customised the login, for example with add-ons, you might be affected. You can try the url to check if you are affected or not.

Patches

The problem has been patched in Products.isurlinportal.

Plone 6.2: upgrade to Products.isurlinportal 4.0.0.
Plone 6.1: upgrade to Products.isurlinportal 3.1.0.
Plone 6.0: upgrade to Products.isurlinportal 2.1.0.
Older Plone versions don't have security support anymore.

Workarounds

There are no known workarounds.

Background

When you are anonymous and land on a page that requires a login, Plone sends you to the login form. After successful login, Plone redirects you back to the page you came from. Various other forms and pages have a similar system.

This could get abused by an attacker to trick Plone into redirecting to a different website. Plone checks the page that would be redirected to. It is only accepted if it is within the Plone site domain or part of a different trusted domain.

The main check for this is in the Products.isurlinportal package. A lot of potentially malicious urls are already safely rejected, but here a loop hole was found.

This was discovered during a penetration test by the CERT-EU Team.

Database specific

{
    "cwe_ids":  [
        "CWE-601"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-02T20:14:23Z",
    "nvd_published_at":  "2026-03-05T21:16:22Z",
    "severity":  "MODERATE"
}

References

Affected packages

PyPI

products-isurlinportal

Package

Name: products-isurlinportal; View open source insights on deps.dev
Purl: pkg:pypi/products-isurlinportal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.0.0a1

Fixed

4.0.0

Affected versions

4.*

4.0.0a1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-43gx-6gv6-3jcp/GHSA-43gx-6gv6-3jcp.json"

products-isurlinportal

Package

Name: products-isurlinportal; View open source insights on deps.dev
Purl: pkg:pypi/products-isurlinportal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.0.0

Fixed

3.1.0

Affected versions

3.*

3.0.0

3.0.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-43gx-6gv6-3jcp/GHSA-43gx-6gv6-3jcp.json"

products-isurlinportal

Package

Name: products-isurlinportal; View open source insights on deps.dev
Purl: pkg:pypi/products-isurlinportal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.1.0

Affected versions

1.*

1.0.0

1.1.0

1.1.1

1.2.0

1.2.1

2.*

2.0.0

2.0.1

2.0.2

2.0.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-43gx-6gv6-3jcp/GHSA-43gx-6gv6-3jcp.json"

products-isurlinportal

Package

Name: products-isurlinportal; View open source insights on deps.dev
Purl: pkg:pypi/products-isurlinportal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.1.0

Affected versions

1.*

1.0.0

1.1.0

1.1.1

1.2.0

1.2.1

2.*

2.0.0

2.0.1

2.0.2

2.0.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-43gx-6gv6-3jcp/GHSA-43gx-6gv6-3jcp.json"

products-isurlinportal

Package

Name: products-isurlinportal; View open source insights on deps.dev
Purl: pkg:pypi/products-isurlinportal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.0.0

Fixed

3.1.0

Affected versions

3.*

3.0.0

3.0.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-43gx-6gv6-3jcp/GHSA-43gx-6gv6-3jcp.json"