CVE-2026-28413: Products.isurlinportal: Possible open redirect when using more than 2 forward slashes
Impact A url /login?camefrom=////evil.example may redirect to an external website after login.
Standard Plone is not affected, but if you have customised the login, for example with add-ons, you might be affected. You can try the url to check if you are affected or not.
Patches The problem has been patched in Products.isurlinportal.
Plone 6.2: upgrade to Products.isurlinportal 4.0.0. Plone 6.1: upgrade to Products.isurlinportal 3.1.0. Plone 6.0: upgrade to Products.isurlinportal 2.1.0. Older Plone versions don't have security support anymore.
Workarounds There are no known workarounds.
Background When you are anonymous and land on a page that requires a login, Plone sends you to the login form. After successful login, Plone redirects you back to the page you came from. Various other forms and pages have a similar system.
This could get abused by an attacker to trick Plone into redirecting to a different website. Plone checks the page that would be redirected to. It is only accepted if it is within the Plone site domain or part of a different trusted domain.
The main check for this is in the Products.isurlinportal package. A lot of potentially malicious urls are already safely rejected, but here a loop hole was found.
This was discovered during a penetration test by the CERT-EU Team.
Other sources
Products.isurlinportal is a replacement for isURLInPortal method in Plone. Prior to versions 2.1.0, 3.1.0, and 4.0.0, a url /login?camefrom=////evil.example may redirect to an external website after login. This issue has been patched in versions 2.1.0, 3.1.0, and 4.0.0.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28413?
CVE-2026-28413 presents a security risk due to potential open redirects to external sites after login.
How do I fix CVE-2026-28413?
To fix CVE-2026-28413, upgrade your installation of Products.isurlinportal to version 2.1.0, 3.1.0, or 4.0.0a1.
Who is affected by CVE-2026-28413?
Users who have customized the Plone login process with add-ons that utilize the affected Products.isurlinportal may be vulnerable to CVE-2026-28413.
What is the impact of CVE-2026-28413 on my website?
The impact of CVE-2026-28413 includes the risk of users being redirected to malicious external websites post-login.
What should I do if I suspect my site is affected by CVE-2026-28413?
If you suspect your site is affected by CVE-2026-28413, test your login URL with suspicious inputs and ensure your package is updated to the latest secure version.