CVE-2026-55248: plone.app.portlets DOS Vulnerability

CVE-2026-55248 Overview

CVE-2026-55248 affects plone.app.portlets, which provides portlets and a Plone-specific user interface for plone.portlets. A member who can add an RSS portlet can supply feed URLs that trigger three distinct issues: uncontrolled resource consumption when downloading oversized feeds, server-side request forgery (SSRF) against internal network services, and stored cross-site scripting (XSS) through JavaScript URLs retained as item links. The vulnerable logic resides in _rss_feed_url_validator, _normal_url_validator, RSSFeed._retrieveFeed, RSSFeed._buildItemDict, and the FEED_DATA in-memory cache.

Critical Impact
Authenticated attackers with portlet privileges can exhaust server memory, probe internal networks, and execute JavaScript against victims via crafted RSS feed entries.

Affected Products

plone.app.portlets versions prior to 5.0.8
plone.app.portlets versions prior to 6.0.4
plone.app.portlets versions prior to 7.0.2

Discovery Timeline

2026-08-28 - CVE-2026-55248 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-55248

Vulnerability Analysis

CVE-2026-55248 combines three weaknesses in the Plone RSS portlet under [CWE-400] Uncontrolled Resource Consumption. First, RSSFeed._retrieveFeed downloads and retains the entire feed response in memory without a size cap, allowing an attacker-controlled URL to return gigabytes of data and exhaust process memory. Second, the URL validators _rss_feed_url_validator and _normal_url_validator accept internal hostnames, raw IP addresses, single-word domains, and explicit ports. This permits an SSRF primitive suitable for probing internal services and enumerating open ports. Third, RSSFeed._buildItemDict preserves javascript: URLs as item links, which execute in the victim's browser when clicked.

Root Cause

The root cause is insufficient input validation on feed URLs and missing bounds on response size. The URL validators approve arbitrary schemes and destinations, and the retrieval routine streams responses into the FEED_DATA cache without enforcing an upper limit.

Attack Vector

An attacker requires an authenticated account with permission to add an RSS portlet. From the network, the attacker sets the feed URL to either an oversized resource, an internal endpoint such as http://127.0.0.1:6379, or a payload feed containing a <link> element with a javascript: scheme. Victims viewing the rendered portlet trigger the XSS payload.

text

// Patch summary from news/+9cf10ab5.bugfix.rst
Security fixes in RSS portlet.

- Be strict in which RSS feed urls we accept in the RSS portlet.
  Only http/https urls. Refuse internal IP addresses, single word
  domains, and port numbers, to avoid abuse as port scanner.
- Refuse downloading gigantic RSS feeds, to avoid denial of service attack.
  You can influence this by setting environment variable
  MAXIMUM_RSS_FEED_SIZE_BYTES. Default maximum is 1 million.

Source: Plone Portlets patch commit 9f16b6f

Detection Methods for CVE-2026-55248

Indicators of Compromise

RSS portlet configurations referencing internal IP ranges (RFC1918), localhost, 127.0.0.1, or explicit non-standard ports.
RSS portlet feed URLs using single-word domains or non-http(s) schemes such as javascript:, file:, or gopher:.
Sudden growth of the FEED_DATA cache or Plone worker memory usage correlated with portlet edits.

Detection Strategies

Audit ZODB objects and portlet assignments for RSS portlets and inspect stored url attributes for suspicious targets.
Inspect outbound HTTP requests from Plone application servers for connections to loopback, link-local, or private IP addresses.
Review rendered portlet HTML for anchor tags whose href begins with javascript:.

Monitoring Recommendations

Alert on Plone processes generating large egress transfers or repeated connections to internal service ports.
Track configuration changes to portlets through Plone audit logs and correlate with authenticated user sessions.
Monitor memory consumption of Zope worker processes and restart thresholds triggered by RSS retrieval.

How to Mitigate CVE-2026-55248

Immediate Actions Required

Upgrade plone.app.portlets to 5.0.8, 6.0.4, or 7.0.2 depending on the deployed major version.
Remove or disable existing RSS portlets configured with untrusted feed URLs until the upgrade completes.
Restrict the Portlets: Manage portlets permission to trusted roles to limit who can add RSS portlets.

Patch Information

The fix is available in plone.app.portlets 5.0.8, 6.0.4, and 7.0.2. The patch restricts feed URLs to http and https, rejects internal IP addresses, single-word domains, and explicit ports, and caps downloads at 1,000,000 bytes by default. See GitHub Security Advisory GHSA-x5g3-w747-2h8q and the Plone Portlets patch commit df5e256.

Workarounds

Place Plone behind an egress proxy that blocks requests to internal IP ranges and non-standard ports.
Set the MAXIMUM_RSS_FEED_SIZE_BYTES environment variable to enforce a strict feed size ceiling after upgrading.
Sanitize rendered RSS output through a Content Security Policy that forbids inline javascript: URIs.

bash

# Enforce a 1 MB RSS feed size cap for the Plone process
export MAXIMUM_RSS_FEED_SIZE_BYTES=1000000

# Upgrade via pip within the Plone virtualenv
pip install --upgrade 'plone.app.portlets>=7.0.2'