Listen to this Post
CVE-2026-57576 is a denial-of-service vulnerability affecting the Plone content management system, specifically within the `plone.app.contenttypes` and `plone.app.dexterity` packages. The flaw resides in the lack of proper input validation and length constraints on user-supplied content fields, including s, descriptions, and uploaded file names. An authenticated user with the necessary permissions to create or edit content can submit excessively long strings in these fields. Because the application does not enforce a maximum length limit at the schema or validation layer, the oversized data is accepted and processed.
When a file is uploaded with an extremely long filename, the system uses that filename to populate the field of the newly created content object. Without truncation or rejection logic, the entire long string becomes part of the content’s metadata. This leads to several cascading issues. The database query that retrieves or manipulates the content may become extremely slow due to the size of the data being handled. The user interface, which must render the in various views, edit forms, and listings, becomes unwieldy and may time out or freeze completely. Even if the content object eventually loads, attempting to edit or delete it can be practically impossible because the UI elements cannot handle the massive string.
The root cause is classified as CWE-400: Uncontrolled Resource Consumption. The application fails to limit the amount of resources (memory, processing time) that can be consumed by a single input field. This is not a remote code execution issue, but it can effectively render a Plone site unusable for all users, constituting a denial of service. The vulnerability was responsibly reported by Aldin Visnjic to the Plone/Zope Security Team. The team decided to develop the fixes publicly to allow community review and feedback, given that some corner cases could be disruptive if not handled carefully.
The patched versions introduce maximum length limits. For s, a limit of 1024 characters is enforced. For descriptions, a limit of 10000 characters is set. When a is derived from a filename, it is truncated to the maximum length. These validations occur at the schema level, causing overly long s and descriptions to be rejected during content creation or editing. The patches are available in `plone.app.contenttypes` versions 5.0.1, 4.0.10, and 3.0.12, as well as corresponding `plone.app.dexterity` versions. There are no known workarounds other than applying the patches.
DailyCVE Form:
Platform: Plone
Version: 3.0.11, 4.0.9, 5.0.0
Vulnerability: DoS Filename Length
Severity: Moderate
date: 2026-06-23
Prediction: 2026-09-23
What Undercode Say:
Analytics:
Query the database for content objects with excessively long s
This can identify potentially affected content after an attack.
zope_db_query "SELECT id, FROM content WHERE LENGTH() > 1024;"
Check the size of the field in the database for a specific object.
zope_db_query "SELECT LENGTH() FROM content WHERE id = 'some_object_id';"
Monitor the response time of the Plone site to detect DoS conditions.
curl -o /dev/null -s -w "%{time_total}\n" http://plone-site/Plone/front-page
The vulnerable code path in plone.app.contenttypes The filename is used to set the without length validation. def createContent(self, id, filename, kwargs): ... existing code ... if filename: No truncation or validation of filename length = filename ... existing code ...
Exploit: (Educational Purposes!)
Educational example: Upload a file with an extremely long filename
This demonstrates the vulnerability in an unpatched system.
Generate a filename that exceeds 1024 characters
LONG_FILENAME=$(python -c "print('A' 2000)")".txt"
Use curl to upload the file with the long filename to a Plone site
The authenticated user must have permission to create content.
curl -X POST -u "username:password" \
-F "file=@/path/to/somefile;filename=${LONG_FILENAME}" \
"http://plone-site/Plone/++add++File"
The server may become unresponsive or the content may be difficult to manage.
Protection: from this CVE
Upgrade plone.app.contenttypes to a patched version pip install --upgrade "plone.app.contenttypes==5.0.1" Or, if using constraints file: Add the following to your constraints.txt plone.app.contenttypes==5.0.1 plone.app.dexterity==5.0.1
Verify the patch is applied by checking for length validation In a patched version, the schema will enforce a max_length. from plone.app.contenttypes.content import File from plone.app.dexterity.behaviors.metadata import IDublinCore The field should have a max_length constraint. Check the schema definition or run a test to ensure long s are rejected.
Impact:
An authenticated user can create content with excessively long filenames, leading to a denial of service. The Plone site can become unresponsive, and existing content may become difficult or impossible to edit or delete through the UI. This affects the availability of the entire Plone site for all users, including administrators. The vulnerability requires authentication but not elevated privileges beyond the ability to create content.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
