PYSEC-2026-2887
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/plone-app-theming/PYSEC-2026-2887.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-2887
- Aliases
- Published
- 2026-07-09T16:49:33.069290Z
- Modified
- 2026-07-13T16:43:23.313589639Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- SSRF attacks via tracebacks in Plone
- Details
-
Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2020-28735
- https://github.com/plone/Products.CMFPlone/issues/3209
- https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt
- https://github.com/advisories/GHSA-x7wf-5mjc-6x76
- https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-247.yaml
- https://www.misakikata.com/codes/plone/python-en.html
- https://pypi.org/project/plone-app-theming
Affected packages
PyPI / plone-app-theming
Package
- Name
- plone-app-theming
- View open source insights on deps.dev
- Purl
- pkg:pypi/plone-app-theming
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed4.1.6
Affected versions
1.*
1.0b1
1.0b2
1.0b3
1.0b4
1.0b5
1.0b6
1.0b7
1.0b8
1.0b9
1.0
1.0.1
1.0.2
1.0.3
1.0.4
1.1a1
1.1a2
1.1b1
1.1b2
1.1
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.2.10
1.2.11
1.2.12
1.2.13
1.2.14
1.2.15
1.2.16
1.2.17
1.2.18
1.2.19
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
2.*
2.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
3.*
3.0.0
3.0.1
4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.1.0
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5