{"affected":[{"database_specific":{"last_known_affected_version_range":"<= 7.0.1"},"package":{"ecosystem":"PyPI","name":"plone.app.portlets"},"ranges":[{"events":[{"introduced":"7.0.0"},{"fixed":"7.0.2"}],"type":"ECOSYSTEM"}]},{"database_specific":{"last_known_affected_version_range":"<= 6.0.3"},"package":{"ecosystem":"PyPI","name":"plone.app.portlets"},"ranges":[{"events":[{"introduced":"6.0.0"},{"fixed":"6.0.4"}],"type":"ECOSYSTEM"}]},{"database_specific":{"last_known_affected_version_range":"<= 5.0.7"},"package":{"ecosystem":"PyPI","name":"plone.app.portlets"},"ranges":[{"events":[{"introduced":"5.0.0"},{"fixed":"5.0.8"}],"type":"ECOSYSTEM"}]}],"aliases":["CVE-2026-57149"],"database_specific":{"cwe_ids":["CWE-95"],"github_reviewed":true,"github_reviewed_at":"2026-09-23T13:55:47Z","nvd_published_at":"2026-09-22T19:16:43Z","severity":"CRITICAL"},"details":"### Impact\nThe Classic portlet (plone.app.portlets.portlets.classic) used its user-supplied template/macro fields to build a TALES path expression that was then evaluated by the TAL path() helper. Because the value was interpreted as a full TALES expression, a user able to add or edit a Classic portlet could supply a crafted value that escapes simple path traversal and is evaluated as arbitrary code.\n\nThis is exploitable by any authenticated user who can configure a Classic portlet - which, with the default role map, includes regular users on their personal dashboard. The result is code execution in the context of the Plone process, i.e. a privilege escalation across the trust boundary between an authenticated web user and the server-side process.\n\n### Patches\nThe problem has been patched in `plone.app.portlets`\n\n* For Plone 6.2, upgrade to `plone.app.portlets` 7.0.2.\n* For Plone 6.1, upgrade to `plone.app.portlets` 6.0.4.\n* For Plone 6.0, upgrade to `plone.app.portlets` 5.0.8.\n\n### Workarounds\nIf upgrading is not immediately possible:\n\n- Restrict who can manage portlets: remove the `plone.app.portlets.ManageOwnPortlets` permission from untrusted roles, and limit Manage portlets to trusted administrators (usually this is already restricted to the Manager and Site Administrator roles).\n- Where the Classic portlet is not needed, unregister it so it cannot be added. This would need to be done by editing a `portlets.xml` in your own code, so it is not a quick fix.\n- You could also effectively disable showing the classic portlet by customising its template. In the Zope Management Interface go to the `portal_view_customizations` tool, locate the `classic.pt` template and click it. Click the Customize button.  Remove all text and replace it with `<div>The classic portlet was disabled.</div>`. (This is not a recommended way of customising a template, but in this case it is quite effective.)\n\n### Credits\n\nDiscovered by Giuseppe Caruso, and reported to the [Plone/Zope Security Team](mailto:security@plone.org). Thanks!","id":"GHSA-rr49-f9g6-c9r5","modified":"2026-09-23T13:55:47Z","published":"2026-09-23T13:55:47Z","references":[{"type":"WEB","url":"https://github.com/plone/plone.app.portlets/security/advisories/GHSA-rr49-f9g6-c9r5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57149"},{"type":"WEB","url":"https://github.com/plone/plone.app.portlets/commit/1d9cacacfad9ed08b890dadc6e75741e295dc151"},{"type":"WEB","url":"https://github.com/plone/plone.app.portlets/commit/8a0641dc4054a2b13834bba00c67cd9a2fd189e1"},{"type":"WEB","url":"https://github.com/plone/plone.app.portlets/commit/fb979f01b57dd2fc06c90ee6577eb5eb285da8f1"},{"type":"PACKAGE","url":"https://github.com/plone/plone.app.portlets"},{"type":"WEB","url":"https://github.com/plone/plone.app.portlets/releases/tag/5.0.8"},{"type":"WEB","url":"https://github.com/plone/plone.app.portlets/releases/tag/6.0.4"},{"type":"WEB","url":"https://github.com/plone/plone.app.portlets/releases/tag/7.0.2"}],"schema_version":"1.4.0","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","type":"CVSS_V3"}],"summary":"plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection"}