CVE-2026-57149: plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection
The Classic portlet (plone.app.portlets.portlets.classic) used its user-supplied template/macro fields to build a TALES path expression that was then evaluated by the TAL path() helper. Because the value was interpreted as a full TALES expression, a user able to add or edit a Classic portlet could supply a crafted value that escapes simple path traversal and is evaluated as arbitrary code.
This is exploitable by any authenticated user who can configure a Classic portlet - which, with the default role map, includes regular users on their personal dashboard. The result is code execution in the context of the Plone process, i.e. a privilege escalation across the trust boundary between an authenticated web user and the server-side process.
References
- github.com/advisories/GHSA-rr49-f9g6-c9r5
- github.com/plone/plone.app.portlets/commit/1d9cacacfad9ed08b890dadc6e75741e295dc151
- github.com/plone/plone.app.portlets/commit/8a0641dc4054a2b13834bba00c67cd9a2fd189e1
- github.com/plone/plone.app.portlets/commit/fb979f01b57dd2fc06c90ee6577eb5eb285da8f1
- github.com/plone/plone.app.portlets/releases/tag/5.0.8
- github.com/plone/plone.app.portlets/releases/tag/6.0.4
- github.com/plone/plone.app.portlets/releases/tag/7.0.2
- github.com/plone/plone.app.portlets/security/advisories/GHSA-rr49-f9g6-c9r5
- nvd.nist.gov/vuln/detail/CVE-2026-57149
Code Behaviors & Features
Detect and mitigate CVE-2026-57149 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →