{"id":"PYSEC-2026-4138","summary":"plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection","details":"### Impact\nThe Classic portlet (plone.app.portlets.portlets.classic) used its user-supplied template/macro fields to build a TALES path expression that was then evaluated by the TAL path() helper. Because the value was interpreted as a full TALES expression, a user able to add or edit a Classic portlet could supply a crafted value that escapes simple path traversal and is evaluated as arbitrary code.\n\nThis is exploitable by any authenticated user who can configure a Classic portlet - which, with the default role map, includes regular users on their personal dashboard. The result is code execution in the context of the Plone process, i.e. a privilege escalation across the trust boundary between an authenticated web user and the server-side process.\n\n### Patches\nThe problem has been patched in `plone.app.portlets`\n\n* For Plone 6.2, upgrade to `plone.app.portlets` 7.0.2.\n* For Plone 6.1, upgrade to `plone.app.portlets` 6.0.4.\n* For Plone 6.0, upgrade to `plone.app.portlets` 5.0.8.\n\n### Workarounds\nIf upgrading is not immediately possible:\n\n- Restrict who can manage portlets: remove the `plone.app.portlets.ManageOwnPortlets` permission from untrusted roles, and limit Manage portlets to trusted administrators (usually this is already restricted to the Manager and Site Administrator roles).\n- Where the Classic portlet is not needed, unregister it so it cannot be added. This would need to be done by editing a `portlets.xml` in your own code, so it is not a quick fix.\n- You could also effectively disable showing the classic portlet by customising its template. In the Zope Management Interface go to the `portal_view_customizations` tool, locate the `classic.pt` template and click it. Click the Customize button.  Remove all text and replace it with `\u003cdiv\u003eThe classic portlet was disabled.\u003c/div\u003e`. (This is not a recommended way of customising a template, but in this case it is quite effective.)\n\n### Credits\n\nDiscovered by Giuseppe Caruso, and reported to the [Plone/Zope Security Team](mailto:security@plone.org). Thanks!","aliases":["CVE-2026-57149","GHSA-rr49-f9g6-c9r5"],"modified":"2026-10-01T17:45:15.992001624Z","published":"2026-10-01T16:38:38.269267Z","references":[{"type":"WEB","url":"https://github.com/plone/plone.app.portlets/security/advisories/GHSA-rr49-f9g6-c9r5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57149"},{"type":"WEB","url":"https://github.com/plone/plone.app.portlets/commit/1d9cacacfad9ed08b890dadc6e75741e295dc151"},{"type":"WEB","url":"https://github.com/plone/plone.app.portlets/commit/8a0641dc4054a2b13834bba00c67cd9a2fd189e1"},{"type":"WEB","url":"https://github.com/plone/plone.app.portlets/commit/fb979f01b57dd2fc06c90ee6577eb5eb285da8f1"},{"type":"PACKAGE","url":"https://github.com/plone/plone.app.portlets"},{"type":"WEB","url":"https://github.com/plone/plone.app.portlets/releases/tag/5.0.8"},{"type":"WEB","url":"https://github.com/plone/plone.app.portlets/releases/tag/6.0.4"},{"type":"WEB","url":"https://github.com/plone/plone.app.portlets/releases/tag/7.0.2"},{"type":"PACKAGE","url":"https://pypi.org/project/plone-app-portlets"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-rr49-f9g6-c9r5"}],"affected":[{"package":{"name":"plone-app-portlets","ecosystem":"PyPI","purl":"pkg:pypi/plone-app-portlets"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.8"},{"introduced":"6.0.0"},{"fixed":"6.0.4"},{"introduced":"7.0.0"},{"fixed":"7.0.2"},{"introduced":"5.0.0"},{"fixed":"5.0.8"}]}],"versions":["5.0.0","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","6.0.0","6.0.1","6.0.2","6.0.3","7.0.0","7.0.1"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/plone-app-portlets/PYSEC-2026-4138.yaml"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}