Vulnerabilities in pkg:pypi/Products.isurlinportal

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-43gx-6gv6-3jcp",
  "modified" : "2026-06-08T18:34:31Z",
  "published" : "2026-03-02T20:14:23Z",
  "aliases" : [ "CVE-2026-28413" ],
  "summary" : "Products.isurlinportal has possible open redirect when using more than 2 forward slashes",
  "details" : "### Impact\nA url `/login?came_from=////evil.example` may redirect to an external website after login.\n\nStandard Plone is not affected, but if you have customised the login, for example with add-ons, you might be affected. You can try the url to check if you are affected or not.\n\n### Patches\nThe problem has been patched in `Products.isurlinportal`.\n\n* Plone 6.2: upgrade to `Products.isurlinportal` 4.0.0.\n* Plone 6.1: upgrade to `Products.isurlinportal` 3.1.0.\n* Plone 6.0: upgrade to `Products.isurlinportal` 2.1.0.\n* Older Plone versions don't have security support anymore.\n\n### Workarounds\nThere are no known workarounds.\n\n### Background\nWhen you are anonymous and land on a page that requires a login, Plone sends you to the login form. After successful login, Plone redirects you back to the page you came from.  Various other forms and pages have a similar system.\n\nThis could get abused by an attacker to trick Plone into redirecting to a different website. Plone checks the page that would be redirected to. It is only accepted if it is within the Plone site domain or part of a different trusted domain.\n\nThe main check for this is in the `Products.isurlinportal` package. A lot of potentially malicious urls are already safely rejected, but here a loop hole was found.\n\nThis was discovered during a penetration test by the CERT-EU Team.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "Products.isurlinportal"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.0.0a1"
      }, {
        "fixed" : "4.0.0"
      } ]
    } ],
    "versions" : [ "4.0.0a1" ]
  }, {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "Products.isurlinportal"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.0.0"
      }, {
        "fixed" : "3.1.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "Products.isurlinportal"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.1.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "products-isurlinportal"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.1.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "products-isurlinportal"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.0.0"
      }, {
        "fixed" : "3.1.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/plone/Products.isurlinportal/security/advisories/GHSA-43gx-6gv6-3jcp"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-28413"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/plone/Products.isurlinportal"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pypa/advisory-database/tree/main/vulns/products-isurlinportal/PYSEC-2026-112.yaml"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-601" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-02T20:14:23Z",
    "nvd_published_at" : "2026-03-05T21:16:22Z"
  }
}