A user capable of adding an RSS portlet can set the feed URL to a source that returns an extremely large payload. The module downloads the full response into memory and keeps it, which can exhaust server resources and cause a denial of service. The URL validation also accepts internal hostnames, IP addresses, single‑word domains, and explicit ports, enabling the application to issue internal network requests that may probe and enumerate internal services. Additionally, a malicious RSS item can supply a JavaScript URL which is stored as the item link; it can execute code when the item is viewed by another user, providing a potential cross‑site scripting vector.

The vulnerable component is the Plone portlets package, particularly plone.app.portlets. Versions earlier than 5.0.8, 6.0.4, or 7.0.2 are affected, i.e. every instance of the Plone CMS installed with the default RSS portlet before the corresponding patch releases.

The vulnerability scores a CVSS of 9.1, indicating critical severity. EPSS data is unavailable, but the lack of a KEV listing does not diminish the impact; the server‑side download logic presents a clear attack path for an authenticated portal manager to carry out the denial of service. The exploited path requires only the ability to create or modify an RSS portlet, a capability normally granted to authenticated content managers. Because the application accepts any URL, including internal addresses, an attacker could also use the component to perform internal scanning and potential injection of harmful content into the site.