plone.app.portlets portlets allow an authenticated user who can configure a Classic portlet to supply a crafted template/macro value that is treated as a TALES expression. The TALES path() helper then evaluates this expression as arbitrary code executed with the privileges of the Plone process. This delivers remote code execution and privilege escalation across the boundary between a logged‑in web user and the server side application. The flaw is a classic example of CWE‑95, insecure code execution via user‑supplied input.

The vulnerability affects the Plone CMS product family through the plone.app.portlets package. Versions from 5.0.0 up to but excluding 5.0.8, from 6.0.0 up to 6.0.4, and from 7.0.0 up to 7.0.2 are impacted. All installations that expose a Classic portlet and allow users to add or edit it are susceptible, including default user dashboards where regular users possess portlet manage rights.

The CVSS score of 9.9 marks this flaw as critical, and the lack of an EPSS score means the exploitation probability cannot be quantified, but the attack path is clear for any authenticated user with portlet configuration privileges. The vulnerability is not listed in the CISA KEV catalog, yet its high severity and potential for widespread server compromise demand that it be addressed immediately. The analyst should focus on identifying any Classic portlet instances and the roles that can modify them to assess exposure.