GHSA-43GX-6GV6-3JCP
Vulnerability from github – Published: 2026-03-02 20:14 – Updated: 2026-03-05 22:49Impact
A url /login?came_from=////evil.example may redirect to an external website after login.
Standard Plone is not affected, but if you have customised the login, for example with add-ons, you might be affected. You can try the url to check if you are affected or not.
Patches
The problem has been patched in Products.isurlinportal.
- Plone 6.2: upgrade to
Products.isurlinportal4.0.0. - Plone 6.1: upgrade to
Products.isurlinportal3.1.0. - Plone 6.0: upgrade to
Products.isurlinportal2.1.0. - Older Plone versions don't have security support anymore.
Workarounds
There are no known workarounds.
Background
When you are anonymous and land on a page that requires a login, Plone sends you to the login form. After successful login, Plone redirects you back to the page you came from. Various other forms and pages have a similar system.
This could get abused by an attacker to trick Plone into redirecting to a different website. Plone checks the page that would be redirected to. It is only accepted if it is within the Plone site domain or part of a different trusted domain.
The main check for this is in the Products.isurlinportal package. A lot of potentially malicious urls are already safely rejected, but here a loop hole was found.
This was discovered during a penetration test by the CERT-EU Team.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "Products.isurlinportal"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0a1"
},
{
"fixed": "4.0.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.0.0a1"
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Products.isurlinportal"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.1.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Products.isurlinportal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-28413"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-02T20:14:23Z",
"nvd_published_at": "2026-03-05T21:16:22Z",
"severity": "MODERATE"
},
"details": "### Impact\nA url `/login?came_from=////evil.example` may redirect to an external website after login.\n\nStandard Plone is not affected, but if you have customised the login, for example with add-ons, you might be affected. You can try the url to check if you are affected or not.\n\n### Patches\nThe problem has been patched in `Products.isurlinportal`.\n\n* Plone 6.2: upgrade to `Products.isurlinportal` 4.0.0.\n* Plone 6.1: upgrade to `Products.isurlinportal` 3.1.0.\n* Plone 6.0: upgrade to `Products.isurlinportal` 2.1.0.\n* Older Plone versions don\u0027t have security support anymore.\n\n### Workarounds\nThere are no known workarounds.\n\n### Background\nWhen you are anonymous and land on a page that requires a login, Plone sends you to the login form. After successful login, Plone redirects you back to the page you came from. Various other forms and pages have a similar system.\n\nThis could get abused by an attacker to trick Plone into redirecting to a different website. Plone checks the page that would be redirected to. It is only accepted if it is within the Plone site domain or part of a different trusted domain.\n\nThe main check for this is in the `Products.isurlinportal` package. A lot of potentially malicious urls are already safely rejected, but here a loop hole was found.\n\nThis was discovered during a penetration test by the CERT-EU Team.",
"id": "GHSA-43gx-6gv6-3jcp",
"modified": "2026-03-05T22:49:44Z",
"published": "2026-03-02T20:14:23Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/plone/Products.isurlinportal/security/advisories/GHSA-43gx-6gv6-3jcp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28413"
},
{
"type": "PACKAGE",
"url": "https://github.com/plone/Products.isurlinportal"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Products.isurlinportal has possible open redirect when using more than 2 forward slashes"
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.