PYSEC-2026-2886
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/plone-app-theming/PYSEC-2026-2886.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-2886
- Aliases
- Published
- 2026-07-09T16:49:32.756420Z
- Modified
- 2026-07-13T16:43:11.751432633Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Improper Restriction of XML External Entity Reference in Plone
- Details
-
Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2020-28734
- https://github.com/plone/Products.CMFPlone/issues/3209
- https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt
- https://github.com/advisories/GHSA-wq6x-g685-w5f2
- https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-246.yaml
- https://www.misakikata.com/codes/plone/python-en.html
- https://pypi.org/project/plone-app-theming
Affected packages
PyPI / plone-app-theming
Package
- Name
- plone-app-theming
- View open source insights on deps.dev
- Purl
- pkg:pypi/plone-app-theming
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed4.1.6
Affected versions
1.*
1.0b1
1.0b2
1.0b3
1.0b4
1.0b5
1.0b6
1.0b7
1.0b8
1.0b9
1.0
1.0.1
1.0.2
1.0.3
1.0.4
1.1a1
1.1a2
1.1b1
1.1b2
1.1
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.2.10
1.2.11
1.2.12
1.2.13
1.2.14
1.2.15
1.2.16
1.2.17
1.2.18
1.2.19
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
2.*
2.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
3.*
3.0.0
3.0.1
4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.1.0
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5