CVE-2026-55248 plone.app.portlets: Denial of service via RSS feed portlet
Attackers can cause denial of service via large RSS feeds and perform SSRF to probe internal networks in Plone RSS portlets.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55248?
CVE-2026-55248 is a critical server-side request forgery vulnerability in plone.app.portlets, published on 28 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portlets/rss.py to download and retain excessive data in memory and deny service. The same RSS URL handling accepts internal hosts, IP addresses, single-word domains, and explicit ports, allowing server-side requests that can probe internal network services and open ports. A malicious feed item can also supply a JavaScript URL that is retained as the item link and can execute script when used by a victim. The affected logic includes _rss_feed_url_validator, _normal_url_validator, RSSFeed._retrieveFeed, RSSFeed._buildItemDict, and the FEED_DATA in-memory cache. This issue is fixed in versions 5.0.8, 6.0.4, and 7.0.2.
Weakness: CWE-400
Which versions are affected by CVE-2026-55248?
7 open source packages ship an affected version, including plone.app.portlets and plone-app-portlets.
| Package | Affected | Fixed in |
|---|---|---|
plone.app.portlets PyPI | All versions | 5.0.8 |
plone.app.portlets PyPI | From 6.0.0 | 6.0.4 |
plone.app.portlets PyPI | From 7.0.0 | 7.0.2 |
plone-app-portlets PyPI | All versions | 5.0.8, 6.0.4, 7.0.2 |
plone-app-portlets PyPI | All versions | 5.0.8 |
plone-app-portlets PyPI | From 6.0.0 | 6.0.4 |
1 more packages
plone-app-portlets PyPI | From 7.0.0 | 7.0.2 |
How do I fix CVE-2026-55248?
Upgrade plone.app.portlets to a fixed version for your release line: 5.0.8, 6.0.4 or 7.0.2.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-55248 being exploited?
There is no known exploitation of CVE-2026-55248 in the wild and no public exploit code.
Sources
Also known as GHSA-x5g3-w747-2h8q, PYSEC-2026-3884.