{"answers":{"affected":"7 open source packages ship an affected version, including plone.app.portlets and plone-app-portlets.","exploited":"There is no known exploitation of CVE-2026-55248 in the wild and no public exploit code.","fix":"Upgrade plone.app.portlets to a fixed version for your release line: 5.0.8, 6.0.4 or 7.0.2.","what":"CVE-2026-55248 is a critical server-side request forgery vulnerability in plone.app.portlets, published on 28 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-55248 and fix it if it is affected.\n\nWhat it is: CVE-2026-55248 is a critical server-side request forgery vulnerability in plone.app.portlets, published on 28 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-55248 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- plone.app.portlets (PyPI): affected all versions; fixed in 5.0.8\n- plone.app.portlets (PyPI): affected from 6.0.0; fixed in 6.0.4\n- plone.app.portlets (PyPI): affected from 7.0.0; fixed in 7.0.2\n- plone-app-portlets (PyPI): affected all versions; fixed in 5.0.8, 6.0.4, 7.0.2\n- plone-app-portlets (PyPI): affected all versions; fixed in 5.0.8\n- plone-app-portlets (PyPI): affected from 6.0.0; fixed in 6.0.4\n- plone-app-portlets (PyPI): affected from 7.0.0; fixed in 7.0.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-55248/ (Markdown: https://insights.sbomify.com/CVE-2026-55248/index.md)","id":"CVE-2026-55248","markdown":"https://insights.sbomify.com/CVE-2026-55248/index.md","name":"CVE-2026-55248","record":{"aliases":["GHSA-x5g3-w747-2h8q","PYSEC-2026-3884"],"analysis":{"component_type":"cms_plugin","fix_type":"upgrade","impacts":["denial_of_service","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Plone RSS portlet","requires_auth":"low_privilege","summary":"Attackers can cause denial of service via large RSS feeds and perform SSRF to probe internal networks in Plone RSS portlets.","user_interaction":"not_required","vuln_class":"ssrf"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":9.1,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","version":"3.1"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"description":"plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portlets/rss.py to download and retain excessive data in memory and deny service. The same RSS URL handling accepts internal hosts, IP addresses, single-word domains, and explicit ports, allowing server-side requests that can probe internal network services and open ports. A malicious feed item can also supply a JavaScript URL that is retained as the item link and can execute script when used by a victim. The affected logic includes _rss_feed_url_validator, _normal_url_validator, RSSFeed._retrieveFeed, RSSFeed._buildItemDict, and the FEED_DATA in-memory cache. This issue is fixed in versions 5.0.8, 6.0.4, and 7.0.2.","ecosystems":["PyPI"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"plone.app.portlets: Denial of service via RSS feed portlet","id":"CVE-2026-55248","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"ssrf","year":"2026"},"n_packages":7,"n_references":5,"next":{"headline":"@rtk-ai/rtk-rewrite: OpenClaw Rewrite Plugin Command Injection via execSync Template String","id":"CVE-2026-55249"},"packages":[{"ecosystem":"PyPI","fixed":["5.0.8","6.0.4","7.0.2"],"introduced":["0","6.0.0","7.0.0"],"last_affected":[],"package":"plone-app-portlets","purl":"pkg:pypi/plone-app-portlets","source":"PYSEC-2026-3884"},{"ecosystem":"PyPI","fixed":["5.0.8"],"introduced":["0"],"last_affected":[],"package":"plone-app-portlets","purl":"pkg:pypi/plone-app-portlets","source":"GHSA-x5g3-w747-2h8q"},{"ecosystem":"PyPI","fixed":["6.0.4"],"introduced":["6.0.0"],"last_affected":[],"package":"plone-app-portlets","purl":"pkg:pypi/plone-app-portlets","source":"GHSA-x5g3-w747-2h8q"},{"ecosystem":"PyPI","fixed":["7.0.2"],"introduced":["7.0.0"],"last_affected":[],"package":"plone-app-portlets","purl":"pkg:pypi/plone-app-portlets","source":"GHSA-x5g3-w747-2h8q"},{"ecosystem":"PyPI","fixed":["5.0.8"],"introduced":["0"],"last_affected":[],"package":"plone.app.portlets","purl":null,"source":"GHSA-x5g3-w747-2h8q"},{"ecosystem":"PyPI","fixed":["6.0.4"],"introduced":["6.0.0"],"last_affected":[],"package":"plone.app.portlets","purl":null,"source":"GHSA-x5g3-w747-2h8q"},{"ecosystem":"PyPI","fixed":["7.0.2"],"introduced":["7.0.0"],"last_affected":[],"package":"plone.app.portlets","purl":null,"source":"GHSA-x5g3-w747-2h8q"}],"prev":{"headline":"plone.app.event: Denial of service via iCalendar import","id":"CVE-2026-55247"},"products":["plone.app.portlets"],"published":"2026-08-28","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-28","vendors":["plone"]},"summary":"Attackers can cause denial of service via large RSS feeds and perform SSRF to probe internal networks in Plone RSS portlets.","url":"https://insights.sbomify.com/CVE-2026-55248/"}