# CVE-2026-55248

## Summary

- **CVE ID:** CVE-2026-55248
- **Severity:** CRITICAL
- **CVSS Score:** 9.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H)
- **CWE:** CWE-400
- **Published:** Aug 28, 2026
- **Last Modified:** Aug 28, 2026

## Description

plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portlets/rss.py to download and retain excessive data in memory and deny service. The same RSS URL handling accepts internal hosts, IP addresses, single-word domains, and explicit ports, allowing server-side requests that can probe internal network services and open ports. A malicious feed item can also supply a JavaScript URL that is retained as the item link and can execute script when used by a victim. The affected logic includes _rss_feed_url_validator, _normal_url_validator, RSSFeed._retrieveFeed, RSSFeed._buildItemDict, and the FEED_DATA in-memory cache. This issue is fixed in versions 5.0.8, 6.0.4, and 7.0.2.

## Affected Products

- plone — plone.app.portlets (< 5.0.8)
- plone — plone.app.portlets (>= 6.0.0, < 6.0.4)
- plone — plone.app.portlets (>= 7.0.0, < 7.0.2)

## References

- [CNA](https://github.com/plone/plone.app.portlets/security/advisories/GHSA-x5g3-w747-2h8q)
- [CNA](https://github.com/plone/plone.app.portlets/commit/09da52ef7b297daa8e0cfd2361e47c37d9b073ad)
- [CNA](https://github.com/plone/plone.app.portlets/commit/9f16b6fb10211916686c6c346ea174bf517e3fbd)
- [CNA](https://github.com/plone/plone.app.portlets/commit/a3b2c2887165b308cd915cbb87b8276f90a76680)
- [CNA](https://github.com/plone/plone.app.portlets/commit/df5e256baee55083cbd6b9a2623675d4cb26b6cd)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.32%
- **EPSS Percentile:** 24.9

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._