CVE-2026-57149: Plone.app.portlets Remote Code Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-rr49-f9g6-c9r5",
  "modified" : "2026-09-23T13:55:47Z",
  "published" : "2026-09-23T13:55:47Z",
  "aliases" : [ "CVE-2026-57149" ],
  "summary" : "plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection",
  "details" : "### Impact\nThe Classic portlet (plone.app.portlets.portlets.classic) used its user-supplied template/macro fields to build a TALES path expression that was then evaluated by the TAL path() helper. Because the value was interpreted as a full TALES expression, a user able to add or edit a Classic portlet could supply a crafted value that escapes simple path traversal and is evaluated as arbitrary code.\n\nThis is exploitable by any authenticated user who can configure a Classic portlet - which, with the default role map, includes regular users on their personal dashboard. The result is code execution in the context of the Plone process, i.e. a privilege escalation across the trust boundary between an authenticated web user and the server-side process.\n\n### Patches\nThe problem has been patched in `plone.app.portlets`\n\n* For Plone 6.2, upgrade to `plone.app.portlets` 7.0.2.\n* For Plone 6.1, upgrade to `plone.app.portlets` 6.0.4.\n* For Plone 6.0, upgrade to `plone.app.portlets` 5.0.8.\n\n### Workarounds\nIf upgrading is not immediately possible:\n\n- Restrict who can manage portlets: remove the `plone.app.portlets.ManageOwnPortlets` permission from untrusted roles, and limit Manage portlets to trusted administrators (usually this is already restricted to the Manager and Site Administrator roles).\n- Where the Classic portlet is not needed, unregister it so it cannot be added. This would need to be done by editing a `portlets.xml` in your own code, so it is not a quick fix.\n- You could also effectively disable showing the classic portlet by customising its template. In the Zope Management Interface go to the `portal_view_customizations` tool, locate the `classic.pt` template and click it. Click the Customize button.  Remove all text and replace it with `<div>The classic portlet was disabled.</div>`. (This is not a recommended way of customising a template, but in this case it is quite effective.)\n\n### Credits\n\nDiscovered by Giuseppe Caruso, and reported to the [Plone/Zope Security Team](mailto:security@plone.org). Thanks!",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "plone.app.portlets"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "7.0.0"
      }, {
        "fixed" : "7.0.2"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 7.0.1"
    }
  }, {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "plone.app.portlets"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "6.0.0"
      }, {
        "fixed" : "6.0.4"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 6.0.3"
    }
  }, {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "plone.app.portlets"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "5.0.0"
      }, {
        "fixed" : "5.0.8"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 5.0.7"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/plone/plone.app.portlets/security/advisories/GHSA-rr49-f9g6-c9r5"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-57149"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/plone/plone.app.portlets/commit/1d9cacacfad9ed08b890dadc6e75741e295dc151"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/plone/plone.app.portlets/commit/8a0641dc4054a2b13834bba00c67cd9a2fd189e1"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/plone/plone.app.portlets/commit/fb979f01b57dd2fc06c90ee6577eb5eb285da8f1"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/plone/plone.app.portlets"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/plone/plone.app.portlets/releases/tag/5.0.8"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/plone/plone.app.portlets/releases/tag/6.0.4"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/plone/plone.app.portlets/releases/tag/7.0.2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-95" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-23T13:55:47Z",
    "nvd_published_at" : "2026-09-22T19:16:43Z"
  }
}