Plone iCalendar Import Flaw Enables Site-Wide DoS, SSRF, and Stored XSS (CVE-2026-55247)

What happened

The Plone Security Team disclosed a vulnerability in plone.app.event, the calendaring add-on for the Plone CMS, tracked as CVE-2026-55247 and published as a GitHub Security Advisory (GHSA-r82h-mqw3-fc56) with a CVSS score of 9.1. According to the advisory, the iCalendar import feature can be abused by a logged-in editor to take the entire site offline (denial of service), force the server to make requests into the internal network and read local calendar files (server-side request forgery), and store cross-site scripting via the event URL field. The issue was reported by researcher Timothy Dudley through Plone's responsible disclosure process. A proof-of-concept is noted as publicly available.

Why it matters

This affects any Plone deployment using plone.app.event across the 6.0, 6.1, and 6.2 release lines. Notably, the DoS and SSRF vectors require only an authenticated editor account — not an administrator — which lowers the bar for insider abuse or a compromised low-privilege credential to escalate into service outage or internal network reconnaissance. The stored XSS component adds a persistence angle for any visitor who views the affected event, and per the advisory there is currently no workaround for that piece.

What defenders should do now

• Upgrade plone.app.event immediately: 6.0.1 for Plone 6.2, or 5.2.4 for Plone 6.0/6.1.
• If patching isn't immediately possible, restrict the "plone.app.event: Import Ical" permission to the Manager role via the Security tab in the Zope Management Interface (manage_access) at the site root — this mitigates the DoS/SSRF path but not the stored XSS.
• Hunt for anomalous iCalendar import activity from non-Manager accounts, unexpected outbound requests from the Plone server to internal hosts, and unusual read access to local filesystem paths that could indicate SSRF-driven file disclosure.
• Review recently created or edited events for suspicious content in URL fields as a possible indicator of stored XSS attempts, since no workaround currently exists for that vector.

Developing intel

This is a same-day advisory and details may evolve as the community and vendor share further guidance. For the authoritative write-up, patch versions, and updates, see the original GitHub Security Advisory: GHSA-r82h-mqw3-fc56.