Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11…
Priority LOW 27CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.
Summary
Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary files via a .. (dot dot) in the path parameter in a getFile action to Plone/++theme++barceloneta/@@plone.resourceeditor.filemanager-actions.
Why it matters now
EPSS 0.02604 85th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Plone (PyPI): 5.0.7, 4.3.12Red Hat: 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | Plone (PyPI) | 5.0 to before 5.0.7 | 5.0.7 | Patch available | GHSA-m7f9-65wr-pwch |
| — | Plone (PyPI) | 4.2 to before 4.3.12 | 4.3.12 | Patch available | GHSA-m7f9-65wr-pwch |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- Plone (PyPI) Vendor— Affected 5.0 to before 5.0.7 Fixed in 5.0.7 Patch available GHSA-m7f9-65wr-pwch
- Plone (PyPI) Vendor— Affected 4.2 to before 4.3.12 Fixed in 4.3.12 Patch available GHSA-m7f9-65wr-pwch
CPE configurations NVD · 32
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:plone:plone:4.2:*:*:*:*:*:*:* | 4.2 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:4.2.1:*:*:*:*:*:*:* | 4.2.1 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:4.2.2:*:*:*:*:*:*:* | 4.2.2 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:4.2.3:*:*:*:*:*:*:* | 4.2.3 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:4.2.4:*:*:*:*:*:*:* | 4.2.4 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:4.2.5:*:*:*:*:*:*:* | 4.2.5 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:4.2.6:*:*:*:*:*:*:* | 4.2.6 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:4.2.7:*:*:*:*:*:*:* | 4.2.7 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:4.3:*:*:*:*:*:*:* | 4.3 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:4.3.1:*:*:*:*:*:*:* | 4.3.1 | Vulnerable | plone |
- cpe:2.3:a:plone:plone:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·plone
- cpe:2.3:a:plone:plone:4.2.1:*:*:*:*:*:*:* Versions 4.2.1 Vulnerable ·plone
- cpe:2.3:a:plone:plone:4.2.2:*:*:*:*:*:*:* Versions 4.2.2 Vulnerable ·plone
- cpe:2.3:a:plone:plone:4.2.3:*:*:*:*:*:*:* Versions 4.2.3 Vulnerable ·plone
- cpe:2.3:a:plone:plone:4.2.4:*:*:*:*:*:*:* Versions 4.2.4 Vulnerable ·plone
- cpe:2.3:a:plone:plone:4.2.5:*:*:*:*:*:*:* Versions 4.2.5 Vulnerable ·plone
- cpe:2.3:a:plone:plone:4.2.6:*:*:*:*:*:*:* Versions 4.2.6 Vulnerable ·plone
- cpe:2.3:a:plone:plone:4.2.7:*:*:*:*:*:*:* Versions 4.2.7 Vulnerable ·plone
- cpe:2.3:a:plone:plone:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·plone
- cpe:2.3:a:plone:plone:4.3.1:*:*:*:*:*:*:* Versions 4.3.1 Vulnerable ·plone
Show 22 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:plone:plone:4.3.2:*:*:*:*:*:*:* | 4.3.2 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:4.3.3:*:*:*:*:*:*:* | 4.3.3 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:4.3.4:*:*:*:*:*:*:* | 4.3.4 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:4.3.5:*:*:*:*:*:*:* | 4.3.5 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:4.3.6:*:*:*:*:*:*:* | 4.3.6 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:4.3.7:*:*:*:*:*:*:* | 4.3.7 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:4.3.8:*:*:*:*:*:*:* | 4.3.8 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:4.3.9:*:*:*:*:*:*:* | 4.3.9 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:4.3.10:*:*:*:*:*:*:* | 4.3.10 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:4.3.11:*:*:*:*:*:*:* | 4.3.11 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:5.0:a1:*:*:*:*:*:* | 5.0 a1 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:5.0:rc1:*:*:*:*:*:* | 5.0 rc1 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:5.0:rc2:*:*:*:*:*:* | 5.0 rc2 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:5.0:rc3:*:*:*:*:*:* | 5.0 rc3 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:5.0.1:*:*:*:*:*:*:* | 5.0.1 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:5.0.2:*:*:*:*:*:*:* | 5.0.2 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:5.0.3:*:*:*:*:*:*:* | 5.0.3 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:5.0.4:*:*:*:*:*:*:* | 5.0.4 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:5.0.5:*:*:*:*:*:*:* | 5.0.5 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:5.0.6:*:*:*:*:*:*:* | 5.0.6 | Vulnerable | plone |
| cpe:2.3:a:plone:plone:5.1a1:*:*:*:*:*:*:* | 5.1a1 | Vulnerable | plone |
- cpe:2.3:a:plone:plone:4.3.2:*:*:*:*:*:*:* Versions 4.3.2 Vulnerable ·plone
- cpe:2.3:a:plone:plone:4.3.3:*:*:*:*:*:*:* Versions 4.3.3 Vulnerable ·plone
- cpe:2.3:a:plone:plone:4.3.4:*:*:*:*:*:*:* Versions 4.3.4 Vulnerable ·plone
- cpe:2.3:a:plone:plone:4.3.5:*:*:*:*:*:*:* Versions 4.3.5 Vulnerable ·plone
- cpe:2.3:a:plone:plone:4.3.6:*:*:*:*:*:*:* Versions 4.3.6 Vulnerable ·plone
- cpe:2.3:a:plone:plone:4.3.7:*:*:*:*:*:*:* Versions 4.3.7 Vulnerable ·plone
- cpe:2.3:a:plone:plone:4.3.8:*:*:*:*:*:*:* Versions 4.3.8 Vulnerable ·plone
- cpe:2.3:a:plone:plone:4.3.9:*:*:*:*:*:*:* Versions 4.3.9 Vulnerable ·plone
- cpe:2.3:a:plone:plone:4.3.10:*:*:*:*:*:*:* Versions 4.3.10 Vulnerable ·plone
- cpe:2.3:a:plone:plone:4.3.11:*:*:*:*:*:*:* Versions 4.3.11 Vulnerable ·plone
- cpe:2.3:a:plone:plone:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·plone
- cpe:2.3:a:plone:plone:5.0:a1:*:*:*:*:*:* Versions 5.0 a1 Vulnerable ·plone
- cpe:2.3:a:plone:plone:5.0:rc1:*:*:*:*:*:* Versions 5.0 rc1 Vulnerable ·plone
- cpe:2.3:a:plone:plone:5.0:rc2:*:*:*:*:*:* Versions 5.0 rc2 Vulnerable ·plone
- cpe:2.3:a:plone:plone:5.0:rc3:*:*:*:*:*:* Versions 5.0 rc3 Vulnerable ·plone
- cpe:2.3:a:plone:plone:5.0.1:*:*:*:*:*:*:* Versions 5.0.1 Vulnerable ·plone
- cpe:2.3:a:plone:plone:5.0.2:*:*:*:*:*:*:* Versions 5.0.2 Vulnerable ·plone
- cpe:2.3:a:plone:plone:5.0.3:*:*:*:*:*:*:* Versions 5.0.3 Vulnerable ·plone
- cpe:2.3:a:plone:plone:5.0.4:*:*:*:*:*:*:* Versions 5.0.4 Vulnerable ·plone
- cpe:2.3:a:plone:plone:5.0.5:*:*:*:*:*:*:* Versions 5.0.5 Vulnerable ·plone
- cpe:2.3:a:plone:plone:5.0.6:*:*:*:*:*:*:* Versions 5.0.6 Vulnerable ·plone
- cpe:2.3:a:plone:plone:5.1a1:*:*:*:*:*:*:* Versions 5.1a1 Vulnerable ·plone
Remediation
- Fix · GHSA-m7f9-65wr-pwch Plone (PyPI) Fixed in 5.0.7 Advisory →
- Fix · GHSA-m7f9-65wr-pwch Plone (PyPI) Fixed in 4.3.12 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Will not fix |
Timeline
- 2026-10-02 Threatist record created from CVE-2016-7135
- 2026-10-03 Alias added: GHSA-m7f9-65wr-pwch
References
Patch 2
Advisory 3
Other 5
- https://github.com/plone/Plone
- https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-58.yaml
- https://pypi.org/project/Products.PloneHotfix20160830
- https://web.archive.org/web/20200227230348/http://www.securityfocus.com/bid/92752
- https://web.archive.org/web/20201207134911/http://www.securityfocus.com/archive/1/539572/100/0/threaded
More Plone vulnerabilities
- TI-2011-03162 Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through… CVSS 2.0HIGH 9.3
- TI-2021-13226 An issue in Plone CMS v. CVSS 3.1HIGH 8.8
- TI-2024-15757 The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13… CVSS 3.1HIGH 7.5
- TI-2021-12911 Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted… CVSS 3.1CRITICAL 9.9
- TI-2020-17872 The official plone Docker images before version of 4.3.18-alpine (Alpine specific)… CVSS 3.1CRITICAL 9.8
- TI-2020-06422 A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2016-7135 · CVE Program
- CVE-2016-7135 · NVD
- FIRST EPSS
- GHSA-m7f9-65wr-pwch · GitHub Advisory Database · CC BY 4.0
- CVE-2016-7135 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences