Read the docs
TI-2026-39349 Aliases CVE-2026-54503GHSA-4r4f-gg25-rmg5

plone.app.textfield: Stored XSS by spoofing mime type

Priority LOW 20CWE-80Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-80.

Summary

plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored RichText value when mimeType equals outputMimeType, including values that claim the text/x-html-safe output type. This equality shortcut bypasses the safe_html transform even though the transform itself correctly removes event-handler attributes and unsafe URI schemes. Equal types can result from a RichText field configured with the same mimeType and outputMimeType or from REST API input that supplies text/x-html-safe as its content type. The raw stored value is then emitted through tal:content=structure without escaping, allowing a user who can set a RichText field to store JavaScript that executes in a viewer's browser. This issue is fixed in versions 2.0.2, 3.0.2, and 4.0.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.004 34th percentileScored 2026-11-07
Fix Fixed plone.app.textfield (plone): 2.0.2, 3.0.2, 4.0.1plone.app.textfield (PyPI): 2.0.2, 3.0.2, 4.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ploneplone.app.textfieldbefore 2.0.2; 3.0.0 to before 3.0.2; 4.0.0 to before 4.0.12.0.2, 3.0.2, 4.0.1Patch availableCNA
—plone.app.textfield (PyPI)before 2.0.22.0.2Patch availableGHSA-4r4f-gg25-rmg5
—plone.app.textfield (PyPI)3.0.0 to before 3.0.23.0.2Patch availableGHSA-4r4f-gg25-rmg5
—plone.app.textfield (PyPI)4.0.0 to before 4.0.14.0.1Patch availableGHSA-4r4f-gg25-rmg5
  • plone.app.textfield Vendorplone Affected before 2.0.2; 3.0.0 to before 3.0.2; 4.0.0 to before 4.0.1 Fixed in 2.0.2, 3.0.2, 4.0.1 Patch available CNA
  • plone.app.textfield (PyPI) Vendor— Affected before 2.0.2 Fixed in 2.0.2 Patch available GHSA-4r4f-gg25-rmg5
  • plone.app.textfield (PyPI) Vendor— Affected 3.0.0 to before 3.0.2 Fixed in 3.0.2 Patch available GHSA-4r4f-gg25-rmg5
  • plone.app.textfield (PyPI) Vendor— Affected 4.0.0 to before 4.0.1 Fixed in 4.0.1 Patch available GHSA-4r4f-gg25-rmg5

Remediation

  • Fix · CNA plone.app.textfield (plone) Fixed in 2.0.2, 3.0.2, 4.0.1
  • Fix · GHSA-4r4f-gg25-rmg5 plone.app.textfield (PyPI) Fixed in 2.0.2 Advisory →
  • Fix · GHSA-4r4f-gg25-rmg5 plone.app.textfield (PyPI) Fixed in 3.0.2 Advisory →
  • Fix · GHSA-4r4f-gg25-rmg5 plone.app.textfield (PyPI) Fixed in 4.0.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54503
  2. 2026-10-03 Alias added: GHSA-4r4f-gg25-rmg5

References

Other 5

  • TI-2024-15205 An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could… CVSS 3.1CRITICAL 9.8
  • TI-2011-03162 Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through… CVSS 2.0HIGH 9.3
  • TI-2021-13226 An issue in Plone CMS v. CVSS 3.1HIGH 8.8
  • TI-2024-15757 The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13… CVSS 3.1HIGH 7.5
  • TI-2024-15206 An issue in Plone Docker Official Image 5.2.13 (5221) open-source software allows for… CVSS 3.1MEDIUM 6.1
  • TI-2008-01340 Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the… CVSS 2.0HIGH 10.0
See all 122 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences