CVE-2026-57149
plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection
The Classic portlet (plone.app.portlets.portlets.classic) used its user-supplied template/macro fields to build a TALES path expression that was then evaluated by the TAL path() helper. Because the value was interpreted as a full TALES expression, a user able to add or edit a Classic portlet could supply a crafted value that escapes simple path traversal and is evaluated as arbitrary code.
- No known exploitation
- Severity
- Critical, CVSS 9.9 (v3.1)
- EPSS
- 0.64% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- plone.app.portlets (pip) >= 7.0.0, <= 7.0.1, fixed in 7.0.2 · GHSA-rr49-f9g6-c9r5
- plone.app.portlets (pip) >= 6.0.0, <= 6.0.3, fixed in 6.0.4 · GHSA-rr49-f9g6-c9r5
- plone.app.portlets (pip) >= 5.0.0, <= 5.0.7, fixed in 5.0.8 · GHSA-rr49-f9g6-c9r5