CVE-2026-55248

🗓️ 28 Aug 2026 18:40:50Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 48 Views🌐 WEB

plone.app.portlets DoS, SSRF, and stored XSS via RSS feed portlet before 5.0.8, 6.0.4, 7.0.2.

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2026-55248	28 Aug 202622:08	–	circl
Cvelist	CVE-2026-55248 plone.app.portlets: Denial of service via RSS feed portlet	28 Aug 202618:40	–	cvelist
EUVD	EUVD-2026-67864	28 Aug 202618:40	–	euvd
Github Security Blog	plone.app.portlets vulnerable to denial of service via RSS feed portlet	28 Aug 202618:41	–	github
NVD	CVE-2026-55248	28 Aug 202620:18	–	nvd
OSV	GHSA-X5G3-W747-2H8Q plone.app.portlets vulnerable to denial of service via RSS feed portlet	28 Aug 202618:41	–	osv
Positive Technologies	PT-2026-55511	3 Jul 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-55248 plone.app.portlets: Denial of service via RSS feed portlet	28 Aug 202618:40	–	vulnrichment

Vulners

Node

plone plone.app.portletsRange<5.0.8

plone plone.app.portletsRange6.0.0–6.0.4

plone plone.app.portletsRange7.0.0–7.0.2

[
  {
    "vendor": "plone",
    "product": "plone.app.portlets",
    "versions": [
      {
        "version": "< 5.0.8",
        "status": "affected"
      },
      {
        "version": ">= 6.0.0, < 6.0.4",
        "status": "affected"
      },
      {
        "version": ">= 7.0.0, < 7.0.2",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/plone/plone.app.portlets/security/advisories/GHSA-x5g3-w747-2h8q
github	www.github.com/plone/plone.app.portlets/commit/a3b2c2887165b308cd915cbb87b8276f90a76680
github	www.github.com/plone/plone.app.portlets/commit/9f16b6fb10211916686c6c346ea174bf517e3fbd
github	www.github.com/plone/plone.app.portlets/commit/09da52ef7b297daa8e0cfd2361e47c37d9b073ad
github	www.github.com/plone/plone.app.portlets/commit/df5e256baee55083cbd6b9a2623675d4cb26b6cd

Parameter	Position	Path	Description	CWE
feed_url	path	src/plone/app/portlets/portlets/rss.py	Insecure RSS feed URL handling can trigger SSRF-like behavior and allow malicious feed items (e.g., JavaScript URL) to be processed or executed, leading to denial of service and possible XSS.	CWE-400

28 Aug 2026 22:16Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.19.1

EPSS0.00319

SSVC

CWE-400