DoS, SSRF, and Stored XSS Risk in Plone's RSS Feed Portlet (CVE-2026-55248)

The Plone Security Team has published a GitHub Security Advisory (CVE-2026-55248, CVSS 9.1) for plone.app.portlets, the package that provides Plone's portlet framework. According to the advisory, a member who can add an RSS portlet can point it at a very large remote file, causing Plone to consume excessive memory — a denial-of-service condition. The same mechanism can reportedly be abused to probe internal network hosts and open ports (server-side request forgery), and a malicious RSS feed containing a javascript: URL in a feed item link can result in stored cross-site scripting. The Plone team says the issue was found proactively while reviewing a similar, previously reported plone.app.event vulnerability. A public proof-of-concept is noted as available.

Why It Matters

This affects any Plone 6.0/6.1/6.2 site that allows members — not just administrators — to manage portlets, since adding an RSS portlet is typically a low-privilege action. The combination of DoS, internal network reconnaissance via SSRF, and stored XSS from a single feature makes this relevant to Plone operators regardless of whether they treat their member base as fully trusted, since the SSRF angle could expose internal service topology and the XSS could target other site visitors or administrators.

What Defenders Should Do Now

• Upgrade plone.app.portlets per the advisory: 7.0.2 for Plone 6.2, 6.0.4 for Plone 6.1, or 5.0.8 for Plone 6.0.
• If upgrading isn't immediate, remove the plone.app.portlets.ManageOwnPortlets permission from untrusted roles and confirm portlet management is restricted to Manager/Site Administrator roles.
• Consider unregistering the RSS portlet (via a custom portlets.xml) on sites where it isn't needed.
• From a monitoring angle, watch for outbound requests originating from your Plone application servers to unexpected internal IP ranges or unusual external hosts, and for unusually large or slow-completing outbound HTTP fetches that could indicate the memory-exhaustion pattern.
• Review stored portlet configurations for feed URLs using non-HTTP(S) schemes such as javascript:.

This is a same-day advisory and details may evolve as the community assesses real-world exploitability; treat this as developing intel. For full technical details, workarounds, and patch references, see the original GHSA-x5g3-w747-2h8q advisory.