Description

plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported events, and commits work per event. A logged-in editor can make the server request internal network resources or local calendar files, exhaust resources and take the site offline, and store a malicious event URL that executes script in another user's browser. The fix restricts accepted URLs, applies MAXIMUM_ICAL_IMPORT_SIZE_BYTES and MAXIMUM_ICAL_IMPORT_EVENTS limits, uses transaction savepoints, and validates event URLs. This issue is fixed in versions 5.2.4 and 6.0.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-28T20:18:26.890Z",
  "pubdate": "2026-08-28T20:18:26.890Z",
  "executiveSummary": "The plone.app.event package contains multiple security flaws within the iCalendar import functionality, specifically located in src/plone/app/event/ical/importer.py. The vulnerability stems from insufficient validation and restriction of user-supplied calendar and event URLs during the import process.\nThe impact is significant, as the vulnerability facilitates Server-Side Request Forgery (SSRF), Denial of Service (DoS) via resource exhaustion, and Stored Cross-Site Scripting (XSS). An authenticated attacker with editor privileges can leverage these weaknesses to interact with internal network resources, local file systems, consume system memory or processing capacity, or inject malicious scripts that execute in the context of other users' sessions.\nThis vulnerability affects Plone versions prior to 5.2.4 and 6.0.1. Exploitation requires a valid editor account. The primary risk implications include unauthorized access to internal services, service availability degradation, and potential credential or session compromise through malicious script execution.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper handling of externally supplied iCalendar URLs within src/plone/app/event/ical/importer.py. The application fails to strictly sanitize or restrict the destination of these URLs, allowing the underlying server to initiate requests to arbitrary network locations, including internal network endpoints and local system resources.\nIn the SSRF attack vector, an authenticated editor can provide a URL pointing to internal services not otherwise exposed to the public internet. By forcing the server to fetch these resources, an attacker can perform internal reconnaissance or interact with internal APIs. Furthermore, the lack of strict input validation allows the server to attempt the retrieval of local calendar files if the file system is accessible to the application process.\nThe Denial of Service (DoS) vector is facilitated by the absence of proper boundaries on resource consumption during the import process. Because the application lacked limitations on the size of downloaded bytes or the number of events imported, an attacker can provide a maliciously crafted, oversized iCalendar payload. When the server attempts to parse this payload, it consumes excessive memory or CPU, leading to resource exhaustion that can take the Plone site offline.\nThe Stored XSS vulnerability arises from the storage of malicious event URLs. By injecting a crafted URL containing executable scripts into the event metadata, an attacker ensures that when other users or administrators interact with the imported event, the payload is rendered by the browser. This allows for the execution of unauthorized JavaScript in the context of the victim's session, potentially leading to session hijacking or unauthorized administrative actions.\nPrior to the fix, the transaction management was insufficient, as work was committed per event during the import process. This lack of atomic transaction control exacerbated the impact of interrupted or malicious imports. The remedial measures introduced in versions 5.2.4 and 6.0.1 address these issues by implementing strict URL validation, establishing hard limits on payload sizes (MAXIMUM_ICAL_IMPORT_SIZE_BYTES) and event counts (MAXIMUM_ICAL_IMPORT_EVENTS), and utilizing transaction savepoints to ensure the integrity of the database during the import workflow."
}