Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for plone.app.textfield by plone

    CVE-2026-54503 (GCVE-0-2026-54503)

    Vulnerability from nvd – Published: 2026-09-15 16:38 – Updated: 2026-09-15 19:02
    VLAI
    Title
    plone.app.textfield: Stored XSS by spoofing mime type
    Summary
    plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored RichText value when mimeType equals outputMimeType, including values that claim the text/x-html-safe output type. This equality shortcut bypasses the safe_html transform even though the transform itself correctly removes event-handler attributes and unsafe URI schemes. Equal types can result from a RichText field configured with the same mimeType and outputMimeType or from REST API input that supplies text/x-html-safe as its content type. The raw stored value is then emitted through tal:content=structure without escaping, allowing a user who can set a RichText field to store JavaScript that executes in a viewer's browser. This issue is fixed in versions 2.0.2, 3.0.2, and 4.0.1.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-15 19:02 UTC
    CWE
    • CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
    Assigner
    References
    Impacted products
    Vendor Product Version
    plone plone.app.textfield Affected: < 2.0.2
    Affected: >= 3.0.0, < 3.0.2
    Affected: >= 4.0.0, < 4.0.1
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54503",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T19:02:07.172464Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T19:02:18.109Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "plone.app.textfield",
          "vendor": "plone",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.0.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored RichText value when mimeType equals outputMimeType, including values that claim the text/x-html-safe output type. This equality shortcut bypasses the safe_html transform even though the transform itself correctly removes event-handler attributes and unsafe URI schemes. Equal types can result from a RichText field configured with the same mimeType and outputMimeType or from REST API input that supplies text/x-html-safe as its content type. The raw stored value is then emitted through tal:content=structure without escaping, allowing a user who can set a RichText field to store JavaScript that executes in a viewer\u0027s browser. This issue is fixed in versions 2.0.2, 3.0.2, and 4.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T16:38:38.290Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/plone/plone.app.textfield/security/advisories/GHSA-4r4f-gg25-rmg5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/plone/plone.app.textfield/security/advisories/GHSA-4r4f-gg25-rmg5"
        },
        {
          "name": "https://github.com/plone/plone.app.textfield/commit/0da1aeec2406cf640977eb857a03e792d2c7cac2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/plone/plone.app.textfield/commit/0da1aeec2406cf640977eb857a03e792d2c7cac2"
        },
        {
          "name": "https://github.com/plone/plone.app.textfield/commit/467638e500d804c637031387a227a2b02d12a86f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/plone/plone.app.textfield/commit/467638e500d804c637031387a227a2b02d12a86f"
        },
        {
          "name": "https://github.com/plone/plone.app.textfield/commit/781d517a38524087fe57525a94806684908f852f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/plone/plone.app.textfield/commit/781d517a38524087fe57525a94806684908f852f"
        }
      ],
      "source": {
        "advisory": "GHSA-4r4f-gg25-rmg5",
        "discovery": "UNKNOWN"
      },
      "title": "plone.app.textfield: Stored XSS by spoofing mime type"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54503",
    "datePublished": "2026-09-15T16:38:38.290Z",
    "dateReserved": "2026-06-15T18:01:15.512Z",
    "dateUpdated": "2026-09-15T19:02:18.109Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-54503 (GCVE-0-2026-54503)

    Vulnerability from cvelistv5 – Published: 2026-09-15 16:38 – Updated: 2026-09-15 19:02
    VLAI
    Title
    plone.app.textfield: Stored XSS by spoofing mime type
    Summary
    plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored RichText value when mimeType equals outputMimeType, including values that claim the text/x-html-safe output type. This equality shortcut bypasses the safe_html transform even though the transform itself correctly removes event-handler attributes and unsafe URI schemes. Equal types can result from a RichText field configured with the same mimeType and outputMimeType or from REST API input that supplies text/x-html-safe as its content type. The raw stored value is then emitted through tal:content=structure without escaping, allowing a user who can set a RichText field to store JavaScript that executes in a viewer's browser. This issue is fixed in versions 2.0.2, 3.0.2, and 4.0.1.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-15 19:02 UTC
    CWE
    • CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
    Assigner
    References
    Impacted products
    Vendor Product Version
    plone plone.app.textfield Affected: < 2.0.2
    Affected: >= 3.0.0, < 3.0.2
    Affected: >= 4.0.0, < 4.0.1
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54503",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T19:02:07.172464Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T19:02:18.109Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "plone.app.textfield",
          "vendor": "plone",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.0.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored RichText value when mimeType equals outputMimeType, including values that claim the text/x-html-safe output type. This equality shortcut bypasses the safe_html transform even though the transform itself correctly removes event-handler attributes and unsafe URI schemes. Equal types can result from a RichText field configured with the same mimeType and outputMimeType or from REST API input that supplies text/x-html-safe as its content type. The raw stored value is then emitted through tal:content=structure without escaping, allowing a user who can set a RichText field to store JavaScript that executes in a viewer\u0027s browser. This issue is fixed in versions 2.0.2, 3.0.2, and 4.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T16:38:38.290Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/plone/plone.app.textfield/security/advisories/GHSA-4r4f-gg25-rmg5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/plone/plone.app.textfield/security/advisories/GHSA-4r4f-gg25-rmg5"
        },
        {
          "name": "https://github.com/plone/plone.app.textfield/commit/0da1aeec2406cf640977eb857a03e792d2c7cac2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/plone/plone.app.textfield/commit/0da1aeec2406cf640977eb857a03e792d2c7cac2"
        },
        {
          "name": "https://github.com/plone/plone.app.textfield/commit/467638e500d804c637031387a227a2b02d12a86f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/plone/plone.app.textfield/commit/467638e500d804c637031387a227a2b02d12a86f"
        },
        {
          "name": "https://github.com/plone/plone.app.textfield/commit/781d517a38524087fe57525a94806684908f852f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/plone/plone.app.textfield/commit/781d517a38524087fe57525a94806684908f852f"
        }
      ],
      "source": {
        "advisory": "GHSA-4r4f-gg25-rmg5",
        "discovery": "UNKNOWN"
      },
      "title": "plone.app.textfield: Stored XSS by spoofing mime type"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54503",
    "datePublished": "2026-09-15T16:38:38.290Z",
    "dateReserved": "2026-06-15T18:01:15.512Z",
    "dateUpdated": "2026-09-15T19:02:18.109Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}