Description
plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported events, and commits work per event. A logged-in editor can make the server request internal network resources or local calendar files, exhaust resources and take the site offline, and store a malicious event URL that executes script in another user's browser. The fix restricts accepted URLs, applies MAXIMUM_ICAL_IMPORT_SIZE_BYTES and MAXIMUM_ICAL_IMPORT_EVENTS limits, uses transaction savepoints, and validates event URLs. This issue is fixed in versions 5.2.4 and 6.0.1.
Published: 2026-08-28
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via resource exhaustion, possible client‑side script execution
Action: Immediate Patch
AI Analysis

Impact

plone.app.event’s iCalendar import processed calendars and event URLs without sufficient validation, allowing an editor to import large or complex files and trigger repeated transaction work per event. The code also had no upper bound on the number of bytes or events processed, and it persisted event URLs that could contain malicious scripts run in other users’ browsers. As a result, an authenticated user could drive the site to consume excessive CPU, memory, or disk resources, effectively taking the service offline, and could embed cross‑site scripting payloads into event listings.

Affected Systems

The vulnerability affects the Plone CMS component plone.app.event in all releases older than 5.2.4 and 6.0.1. Users running those legacy versions should verify their installation and identify which branch (5.x or 6.x) they are on.

Risk and Exploitability

The likely attack vector is an authenticated editor using the import function to send large or malicious calendar data, exhausting host resources or injecting client‑side scripts through event URLs. This can be mitigated by applying the official fix or disabling the feature until a patch is applied.

Generated by OpenCVE AI on August 28, 2026 at 20:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade plone.app.event to at least version 5.2.4 or 6.0.1 to enforce URL restrictions and size limits.
  • If an upgrade is not yet possible, temporarily disable the iCalendar import feature or restrict it to IP addresses or domains you trust.
  • Review stored event URLs for suspicious content and remove or sanitize any that could trigger client‑side script execution.
  • Monitor import activity and site performance for signs of induced resource exhaustion, and apply rate‑limiting or additional input validation if available.

Generated by OpenCVE AI on August 28, 2026 at 20:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-r82h-mqw3-fc56 plone.app.event vulnerable to denial of service via iCalendar import
History

Mon, 31 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 31 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Plone
Plone plone.app.event
Vendors & Products Plone
Plone plone.app.event

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported events, and commits work per event. A logged-in editor can make the server request internal network resources or local calendar files, exhaust resources and take the site offline, and store a malicious event URL that executes script in another user's browser. The fix restricts accepted URLs, applies MAXIMUM_ICAL_IMPORT_SIZE_BYTES and MAXIMUM_ICAL_IMPORT_EVENTS limits, uses transaction savepoints, and validates event URLs. This issue is fixed in versions 5.2.4 and 6.0.1.
Title plone.app.event: Denial of service via iCalendar import
Weaknesses CWE-400
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H'}

Subscriptions

Plone Plone.app.event
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-31T18:48:31.264Z

Reserved: 2026-06-16T16:44:00.624Z

Link: CVE-2026-55247

cve-icon Vulnrichment

Updated: 2026-08-31T18:48:20.730Z

cve-icon NVD

Status : Deferred

Published: 2026-08-28T20:18:26.890

Modified: 2026-09-09T21:09:13.080

Link: CVE-2026-55247

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T11:20:08Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption