PYSEC-2026-2882
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/plone-app-event/PYSEC-2026-2882.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-2882
- Aliases
- Published
- 2026-07-09T16:49:33Z
- Modified
- 2026-07-13T16:43:28Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Improper Restriction of XML External Entity Reference in Plone
- Details
-
Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role).
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2020-28736
- https://github.com/plone/Products.CMFPlone/issues/3209
- https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt
- https://github.com/advisories/GHSA-2c8c-84w2-j38j
- https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-248.yaml
- https://www.misakikata.com/codes/plone/python-en.html
- https://pypi.org/project/plone-app-event
Affected packages
PyPI / plone-app-event
Package
- Name
- plone-app-event
- View open source insights on deps.dev
- Purl
- pkg:pypi/plone-app-event
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed3.2.10
Affected versions
1.*
1.0a1
1.0a2
1.0b1
1.0b2
1.0b3
1.0b4
1.0b5
1.0b6
1.0b7
1.0b8
1.0rc1
1.0rc2
1.0rc3
1.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.1.a1
1.1b1
1.1
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.10
1.1.11
1.1.12
1.1.13
1.2
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
2.*
2.0a1
2.0a2
2.0a3
2.0a4
2.0a5
2.0a6
2.0a7
2.0a8
2.0a9
2.0a10
2.0a11
2.0a12
2.0a13
2.0b1
2.0b2
2.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
3.*
3.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1
3.1.1
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.8
3.2.9