Critical Remote Code Execution Chain Fixed in Plone Versions 4.3 to 6.2
The Plone/Zope Security Team disclosed a critical chain of vulnerabilities enabling unauthenticated remote code execution (RCE) on Plone sites, affecting all supported versions and older ones back to 4.3. The highest severity flaw (CVSS 9.8) allows anonymous attackers to modify versioning conditions leading to arbitrary code execution in a sandbox escape scenario through modules like os and permission bypass via plone.restapi. Although no attacks are reported in the wild yet, a proof of concept exists and the advisory highlights the risk of persistent compromise in the database. Immediate update to fixed versions or applying the provided hotfix and restarting Zope instances are strongly recommended. Site owners should inspect versioning conditions and web server logs for signs of compromise as unauthorized changes can survive patching. The flaws were responsibly disclosed by Mokrane ABDELMALEK via Ghent University and Andreas Jung contributed to hardening recommendations. No CVEs yet assigned but requested.
Entenda a falha
A vulnerabilidade
A chain of five advisories (four critical) in Plone lets an anonymous visitor run code on the server, with no login needed. The entry point is Products.CMFEditions (CVSS 9.8), whose conditional modifier classes declare no security, so anyone can change a modifier's TALES condition. Three sandbox escapes (CVSS 9.1 each) in Products.CMFPlone, Products.MimetypesRegistry and plone.batching expose modules such as os to restricted code. A fourth, in plone.restapi (CVSS 4.7), lets protected methods be called. All supported versions and older ones back to 4.3 are affected. Fixed in Plone 6.2.3, 6.1.6 and 6.0.16 (CMFEditions 5.0.2 / 4.0.7, and so on), or via Products.PloneHotfix20261110 for 4.3 through 6.2. No CVE IDs have been assigned yet; they have been requested.
Como funciona
An anonymous visitor reaches a versioning modifier object in the site and changes its TALES condition, title or size limits, because no security is declared on it. The condition is later evaluated as code, either when the attacker triggers it directly or when an editor saves versioned content, in which case it runs with the editor's higher privileges. Plone evaluates TALES expressions and Python Scripts inside Restricted Python, a sandbox. Because several packages opened whole modules to restricted code, that code can reach modules such as os, and through the json module in plone.restapi it can call protected methods on objects, so the sandbox no longer contains it.
Por que é vulnerável
In CMFEditions the root cause is a missing access control: the conditional modifier classes declare no security, so anonymous users can modify them. For the sandbox escape, Products.CMFPlone, Products.MimetypesRegistry and plone.batching used allow_module to open entire modules to restricted code, which also exposed everything those modules import. plone.restapi opened Python's json module the same way; that setting dates from 2015 and nothing in plone.restapi still needs it. The fixes add the missing security and remove these over-broad module permissions, so custom Python Scripts that imported other names from these modules may now get Unauthorized errors.
Onde está
The articles name the conditional modifier classes in Products.CMFEditions (reached via portal_modifier URLs), the allow_module declarations in Products.CMFPlone, Products.MimetypesRegistry and plone.batching, and the json module opened in plone.restapi; no files or functions are given.
Como foi descoberta
Mokrane ABDELMALEK reported the issues through the Ghent University vulnerability disclosure programme, and Andreas Jung suggested extra hardening. The Plone/Zope Security Team released fixes and advisories on November 10, 2026, after a pre-announcement that advised blocking URLs containing portal_modifier. No attacks in the wild have been reported so far.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
The CMFEditions advisory states that a working proof of concept exists, but the team has not released it. The team warns that, with the details now public, current AI tools could turn them into a working exploit quickly. Treat this as an emergency patch. A successful attack can leave changes in the database that survive patching, so check versioning conditions even after updating.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 23:16.
Linha do tempo
-
Critical Remote Code Execution Chain Fixed in Plone Versions 4.3 to 6.2
ler a análise desta fonte ocultar
The Plone/Zope Security Team disclosed a critical chain of vulnerabilities enabling unauthenticated remote code execution (RCE) on Plone sites, affecting all supported versions and older ones back to 4.3. The highest severity flaw (CVSS 9.8) allows anonymous attackers to modify versioning conditions leading to arbitrary code execution in a sandbox escape scenario through modules like os and permission bypass via plone.restapi. Although no attacks are reported in the wild yet, a proof of concept exists and the advisory highlights the risk of persistent compromise in the database. Immediate update to fixed versions or applying the provided hotfix and restarting Zope instances are strongly recommended. Site owners should inspect versioning conditions and web server logs for signs of compromise as unauthorized changes can survive patching. The flaws were responsibly disclosed by Mokrane ABDELMALEK via Ghent University and Andreas Jung contributed to hardening recommendations. No CVEs yet assigned but requested.