Products.isurlinportal includes a method that can redirect users to external sites when the 'came_from' parameter contains more than two forward slashes. An attacker can craft a URL such as /login?came_from=////evil.example, causing the site to send users to a malicious domain after authentication. This leads to an open‑redirect vulnerability, exposing users to phishing or other social‑engineering attacks.

Plone’s Products.isurlinportal component, versions prior to 2.1.0, 3.1.0, and 4.0.0, are vulnerable to this issue.

The CVSS score of 5.3 indicates moderate severity and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no known public exploits at this time. Attackers can target the site remotely by generating a malicious redirect link that includes multiple forward slashes in the 'came_from' parameter. Patching to the fixed versions removes the flaw and eliminates the risk of unwanted redirects for logged‑in users.