iCalendar Import Vulnerability in Plone Event Content Type
CVE-2026-55247

9.1CRITICAL

Key Information:

Vendor

Plone

Status
Plone.app.event
Vendor
CVE Published:
28 August 2026

What is CVE-2026-55247?

The iCalendar import functionality in the Plone event content type is vulnerable due to its inadequate restrictions on calendar and event URLs. This weakness allows a logged-in editor to make external server requests to local resources, potentially exhausting server resources and causing the site to go offline. Furthermore, it could enable the storage of malicious event URLs, leading to cross-site scripting (XSS) attacks in other users' browsers. The issue has been mitigated in subsequent versions by enforcing stricter URL validation, imposing limits on the size of imported data, and implementing transaction savepoints.

Affected Version(s)

plone.app.event < 5.2.4 < 5.2.4

plone.app.event >= 6.0.0, < 6.0.1 < 6.0.0, 6.0.1

References

https://github.com/plone/plone.app.event/security/advisor...
x_refsource_CONFIRM
https://github.com/plone/plone.app.event/commit/1e3c83c15...
x_refsource_MISC
https://github.com/plone/plone.app.event/commit/4de5eb3ea...
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.