CVE-2026-55247: plone.app.event: Denial of service via iCalendar import
Impact By abusing the iCalendar import functionality, a logged-in editor could take the whole site offline, make the server reach into the internal network and read calendar files off disk (SSRF), and store XSS.
Patches The problem has been patched in plone.app.event.
For Plone 6.2: upgrade to plone.app.event 6.0.1 For Plone 6.1: upgrade to plone.app.event 5.2.4 For Plone 6.0: upgrade to plone.app.event 5.2.4
Workarounds In the site root, go to the Security tab of the Zope Management Interface (manageaccess), look for the "plone.app.event: Import Ical" permission, and grant this only to the Manager role. Then only users with the Manager role can use the ical import form.
There is no workaround for the stored XSS in the URL field of events.
The vulnerabilities were discovered by Timothy Dudley and responsibly reported to the Plone Security Team. Thank you!
Other sources
plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported events, and commits work per event. A logged-in editor can make the server request internal network resources or local calendar files, exhaust resources and take the site offline, and store a malicious event URL that executes script in another user's browser. The fix restricts accepted URLs, applies MAXIMUMICALIMPORTSIZEBYTES and MAXIMUMICALIMPORTEVENTS limits, uses transaction savepoints, and validates event URLs. This issue is fixed in versions 5.2.4 and 6.0.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/plone.app.eventto a version that resolves this vulnerability.Fixed in 6.0.1 - Upgrade
Upgrade
pip/plone.app.eventto a version that resolves this vulnerability.Fixed in 5.2.4 - Upgrade
Upgrade
plone.app.eventto a version that resolves this vulnerability.Fixed in 5.2.4 - Upgrade
Upgrade
plone.app.eventto a version that resolves this vulnerability.Fixed in 6.0.1 - Configuration
In the site root, open the Security tab of the Zope Management Interface (manage_access). Find the "plone.app.event: Import Ical" permission and grant it only to the Manager role.
Plone (Zope Management Interface) manage_access: plone.app.event: Import Ical permission = grant only to Manager role
Event History
Frequently Asked Questions
What level of access does an attacker need?
An attacker needs to be logged in with editor-level access and be able to use the iCalendar import functionality. Restricting the import permission to Managers prevents non-Manager editors from accessing the import form.
What should administrators do if they cannot upgrade immediately?
In the site root's Zope Management Interface Security tab (manage_access), grant the "plone.app.event: Import Ical" permission only to the Manager role. This mitigates the import-related denial-of-service and SSRF risks, but does not mitigate the stored XSS in event URL fields.
Which package versions include the fix?
For Plone 6.2, upgrade plone.app.event to 6.0.1. For Plone 6.1 and 6.0, upgrade to plone.app.event 5.2.4.