CVE-2026-55248

plone.app.portlets, the Plone add-on that provides portlets and the Plone-specific portlet user interface, mishandles RSS portlet feed URLs in versions prior to 5.0.8, 6.0.4, and 7.0.2. An authenticated member allowed to add an RSS portlet can set the feed URL to a resource returning a very large response; RSSFeed._retrieveFeed downloads it and retains the data in the in-memory FEED_DATA cache, exhausting memory and denying service (CWE-400). The same URL validation logic (_rss_feed_url_validator, _normal_url_validator) accepts internal hostnames, IP addresses, single-word domains, and explicit ports, so the server-side fetch can be abused for SSRF to probe internal network services and open ports. A malicious feed can also return items whose link is a JavaScript URL, which RSSFeed._buildItemDict preserves, so attacker-supplied script executes in a victim's browser when the link is used. Any Plone deployment running an affected plone.app.portlets version is exposed, though triggering requires a member account with portlet-add privileges; no public proof-of-concept or known exploitation exists, EPSS is 0.3%, and the issue is not in CISA KEV.

What to do: Upgrade plone.app.portlets to one of the fixed versions (5.0.8, 6.0.4, or 7.0.2) matching your release series. Until then, restrict RSS portlet creation to trusted members and audit existing RSS portlets for feed URLs pointing at internal hosts/ports and for javascript: item links. Restricting outbound egress from the Plone server (blocking internal network ranges, single-label hostnames, and explicit ports) limits the SSRF probing, and capping feed sizes limits memory-exhaustion denial of service.