CVE-2026-55247: plone.app.event iCalendar Import DOS Vulnerability

CVE-2026-55247 Overview

CVE-2026-55247 affects plone.app.event, the package that provides the event content type for the Plone content management system. The iCalendar import logic in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, fails to bound downloaded bytes or imported events, and commits transactions per event. A logged-in editor can abuse the importer to make the server fetch internal network resources or local calendar files, exhaust server resources to take the site offline, or store a malicious event URL that executes script in another user's browser. The issue is tracked as CWE-400: Uncontrolled Resource Consumption and resolved in versions 5.2.4 and 6.0.1.

Critical Impact
An authenticated editor can trigger Server-Side Request Forgery (SSRF), site-wide denial of service, and stored cross-site scripting (XSS) through the iCalendar import feature.

Affected Products

plone.app.event versions prior to 5.2.4 (5.x branch)
plone.app.event versions prior to 6.0.1 (6.x branch)
Plone deployments that expose the iCalendar import functionality to editor-role users

Discovery Timeline

2026-08-28 - CVE-2026-55247 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-55247

Vulnerability Analysis

The iCalendar importer at src/plone/app/event/ical/importer.py combines three weaknesses that compound into a single critical issue. First, the importer accepts arbitrary URLs for both the calendar feed and individual event links, including javascript: URIs and URLs pointing at internal hosts or local file resources. Second, it downloads content without enforcing size or timeout limits, allowing an attacker to feed the parser very large payloads. Third, it commits work per event rather than using transaction savepoints, so each imported event permanently mutates database state before the entire batch is validated.

The combination gives an authenticated editor three attack primitives: SSRF against internal services, resource exhaustion that takes the Plone site offline, and stored XSS through malicious event URLs that later render in other users' browsers.

Root Cause

The importer trusts caller-supplied URLs and treats the icalendar feed as bounded input. There is no allow-list on URL schemes, no cap on downloaded bytes, no maximum event count, and no scheme validation on per-event URL fields. Because each event is committed individually, partial imports persist even when later processing fails.

Attack Vector

An attacker needs valid editor credentials on the Plone site. The attacker submits an iCalendar import request pointing at an internal URL (for SSRF), an oversized or slow-loading resource (for DoS), or a crafted feed containing events whose URL field carries a javascript: payload (for stored XSS). No user interaction is required to trigger the server-side effects.

text

+Security: harden the icalendar import to prevent denial of service and stored XSS.
+
+- Be more strict in which urls we accept.
+- Check for timeout and limit the number of bytes.
+  Get this limit from environment variable ``MAXIMUM_ICAL_IMPORT_SIZE_BYTES``, default 100000.
+- Add limit to how many events can be imported via ical.
+  Get this limit from environment variable ``MAXIMUM_ICAL_IMPORT_EVENTS``, default 53.
+- Use transaction savepoints instead of a commit per event.
+- Check that event urls (via import or normal edit) are valid, for example no ``javascript`` urls.
+
+[maurits]

Source: GitHub commit 1e3c83c

Detection Methods for CVE-2026-55247

Indicators of Compromise

Plone event objects whose URL field begins with javascript:, file:, or points to RFC 1918 addresses or localhost
Application logs showing iCalendar import requests targeting internal hostnames or loopback interfaces
Spikes in ZODB transaction volume or memory pressure correlated with @@ical_import or importer endpoint hits
Editor accounts issuing iCalendar imports referencing unusually large remote payloads

Detection Strategies

Review Plone access logs for POST requests to the iCalendar import handler and correlate the referenced URL parameter against an internal network allow-list
Query stored event content for URL fields containing non-http(s) schemes, especially javascript: and data:
Monitor for outbound HTTP requests from the Plone application server to internal addresses, which indicate SSRF attempts

Monitoring Recommendations

Alert on repeated iCalendar imports by the same editor account within short windows
Track process memory and ZODB cache size on Plone application servers for sustained growth during import operations
Log and review any modifications to event objects that change the URL field after initial creation

How to Mitigate CVE-2026-55247

Immediate Actions Required

Upgrade plone.app.event to version 5.2.4 (5.x branch) or 6.0.1 (6.x branch)
Audit existing event content for stored URLs containing dangerous schemes and remove or sanitize them
Restrict editor-role assignments and review recent grants of that role
Set MAXIMUM_ICAL_IMPORT_SIZE_BYTES and MAXIMUM_ICAL_IMPORT_EVENTS environment variables to values appropriate for your deployment

Patch Information

The fix landed in plone.app.event releases 5.2.4 and 6.0.1. The patch restricts accepted URL schemes, enforces MAXIMUM_ICAL_IMPORT_SIZE_BYTES (default 100000) and MAXIMUM_ICAL_IMPORT_EVENTS (default 53) limits, replaces per-event commits with transaction savepoints, and validates event URLs at both import and edit time. Full details are in GHSA-r82h-mqw3-fc56. The change also adds requests as a dependency to support timeout-aware fetching:

python

     install_requires=[
         "plone.base",
         "Products.statusmessages",
+        "requests",
         "icalendar",  # >4.0.2
         "Products.DateRecurringIndex",
         "Products.ZCatalog",