CVE-2026-55248
CriticalCVSS 9.1Summary
plone.app.portlets before versions 5.0.8, 6.0.4, and 7.0.2 allows a member who can add an RSS portlet to set its feed URL to a very large response, causing excessive data retention in memory and denial of service. The RSS URL handling accepts internal hosts, IP addresses, single-word domains, and explicit ports, enabling server-side requests to internal services. A malicious feed item can also supply a JavaScript URL that is retained as the item link and can execute script when used by a victim. This issue is fixed in versions 5.0.8, 6.0.4, and 7.0.2.
Risk Assessment
The vulnerability allows an attacker to perform SSRF attacks, exhaust server resources (DoS), and execute scripts in a victim's browser (XSS), potentially compromising confidentiality and integrity.
Recommendation
Upgrade plone.app.portlets to version 5.0.8, 6.0.4, or 7.0.2 and restrict RSS portlet addition privileges to trusted users.
Original NVD description (English source)
plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portlets/rss.py to download and retain excessive data in memory and deny service. The same RSS URL handling accepts internal hosts, IP addresses, single-word domains, and explicit ports, allowing server-side requests that can probe internal network services and open ports. A malicious feed item can also supply a JavaScript URL that is retained as the item link and can execute script when used by a victim. The affected logic includes _rss_feed_url_validator, _normal_url_validator, RSSFeed._retrieveFeed, RSSFeed._buildItemDict, and the FEED_DATA in-memory cache. This issue is fixed in versions 5.0.8, 6.0.4, and 7.0.2.