CVE-2026-55247

plone.app.event, the package that provides Plone's event content type, accepts insufficiently restricted calendar and event URLs in its iCalendar import (src/plone/app/event/ical/importer.py) in versions prior to 5.2.4 and 6.0.1. A logged-in editor can trigger an import with an attacker-chosen URL, causing the server to fetch internal network resources or local calendar files (SSRF), download an unbounded number of bytes and events, and commit work per event, which can exhaust server resources and take the site offline. The editor can also store a malicious event URL that executes script in another user's browser (stored XSS), consistent with the CVSS scope change. Any Plone deployment running plone.app.event 5.x before 5.2.4 or 6.x before 6.0.1, where editors can use the iCalendar import, is affected. No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation has been reported, and EPSS estimates roughly a 0.3% probability of exploitation within 30 days.

What to do: Upgrade plone.app.event to 5.2.4 on the 5.x branch or 6.0.1 on the 6.x branch, which restrict accepted URLs, enforce the MAXIMUM_ICAL_IMPORT_SIZE_BYTES and MAXIMUM_ICAL_IMPORT_EVENTS limits, use transaction savepoints, and validate event URLs. Until patched, restrict iCalendar import to trusted editors, apply egress filtering so the application server cannot reach internal services or local file URLs, and review stored event URLs for injected script.