Vulnerability-Lookup

CVE-2026-54503 (GCVE-0-2026-54503)

Vulnerability from cvelistv5 – Published: 2026-09-15 16:38 – Updated: 2026-09-15 19:02

Title

plone.app.textfield: Stored XSS by spoofing mime type

Summary

plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored RichText value when mimeType equals outputMimeType, including values that claim the text/x-html-safe output type. This equality shortcut bypasses the safe_html transform even though the transform itself correctly removes event-handler attributes and unsafe URI schemes. Equal types can result from a RichText field configured with the same mimeType and outputMimeType or from REST API input that supplies text/x-html-safe as its content type. The raw stored value is then emitted through tal:content=structure without escaping, allowing a user who can set a RichText field to store JavaScript that executes in a viewer's browser. This issue is fixed in versions 2.0.2, 3.0.2, and 4.0.1.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 19:02 UTC

CWE

CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/plone/plone.app.textfield/secu…	x_refsource_CONFIRM
https://github.com/plone/plone.app.textfield/comm…	x_refsource_MISC
https://github.com/plone/plone.app.textfield/comm…	x_refsource_MISC
https://github.com/plone/plone.app.textfield/comm…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
plone	plone.app.textfield	Affected: < 2.0.2 Affected: >= 3.0.0, < 3.0.2 Affected: >= 4.0.0, < 4.0.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54503",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T19:02:07.172464Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T19:02:18.109Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "plone.app.textfield",
          "vendor": "plone",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.0.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored RichText value when mimeType equals outputMimeType, including values that claim the text/x-html-safe output type. This equality shortcut bypasses the safe_html transform even though the transform itself correctly removes event-handler attributes and unsafe URI schemes. Equal types can result from a RichText field configured with the same mimeType and outputMimeType or from REST API input that supplies text/x-html-safe as its content type. The raw stored value is then emitted through tal:content=structure without escaping, allowing a user who can set a RichText field to store JavaScript that executes in a viewer\u0027s browser. This issue is fixed in versions 2.0.2, 3.0.2, and 4.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T16:38:38.290Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/plone/plone.app.textfield/security/advisories/GHSA-4r4f-gg25-rmg5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/plone/plone.app.textfield/security/advisories/GHSA-4r4f-gg25-rmg5"
        },
        {
          "name": "https://github.com/plone/plone.app.textfield/commit/0da1aeec2406cf640977eb857a03e792d2c7cac2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/plone/plone.app.textfield/commit/0da1aeec2406cf640977eb857a03e792d2c7cac2"
        },
        {
          "name": "https://github.com/plone/plone.app.textfield/commit/467638e500d804c637031387a227a2b02d12a86f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/plone/plone.app.textfield/commit/467638e500d804c637031387a227a2b02d12a86f"
        },
        {
          "name": "https://github.com/plone/plone.app.textfield/commit/781d517a38524087fe57525a94806684908f852f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/plone/plone.app.textfield/commit/781d517a38524087fe57525a94806684908f852f"
        }
      ],
      "source": {
        "advisory": "GHSA-4r4f-gg25-rmg5",
        "discovery": "UNKNOWN"
      },
      "title": "plone.app.textfield: Stored XSS by spoofing mime type"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54503",
    "datePublished": "2026-09-15T16:38:38.290Z",
    "dateReserved": "2026-06-15T18:01:15.512Z",
    "dateUpdated": "2026-09-15T19:02:18.109Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-54503\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-09-15T17:17:21.060\",\"lastModified\":\"2026-09-15T19:17:20.483\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored RichText value when mimeType equals outputMimeType, including values that claim the text/x-html-safe output type. This equality shortcut bypasses the safe_html transform even though the transform itself correctly removes event-handler attributes and unsafe URI schemes. Equal types can result from a RichText field configured with the same mimeType and outputMimeType or from REST API input that supplies text/x-html-safe as its content type. The raw stored value is then emitted through tal:content=structure without escaping, allowing a user who can set a RichText field to store JavaScript that executes in a viewer\u0027s browser. This issue is fixed in versions 2.0.2, 3.0.2, and 4.0.1.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"plone\",\"product\":\"plone.app.textfield\",\"versions\":[{\"version\":\"\u003c 2.0.2\",\"status\":\"affected\"},{\"version\":\"\u003e= 3.0.0, \u003c 3.0.2\",\"status\":\"affected\"},{\"version\":\"\u003e= 4.0.0, \u003c 4.0.1\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-15T19:02:07.172464Z\",\"id\":\"CVE-2026-54503\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-80\"}]}],\"references\":[{\"url\":\"https://github.com/plone/plone.app.textfield/commit/0da1aeec2406cf640977eb857a03e792d2c7cac2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/plone/plone.app.textfield/commit/467638e500d804c637031387a227a2b02d12a86f\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/plone/plone.app.textfield/commit/781d517a38524087fe57525a94806684908f852f\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/plone/plone.app.textfield/security/advisories/GHSA-4r4f-gg25-rmg5\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-54503\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-15T19:02:07.172464Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-15T19:02:13.197Z\"}}], \"cna\": {\"title\": \"plone.app.textfield: Stored XSS by spoofing mime type\", \"source\": {\"advisory\": \"GHSA-4r4f-gg25-rmg5\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"plone\", \"product\": \"plone.app.textfield\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2.0.2\"}, {\"status\": \"affected\", \"version\": \"\u003e= 3.0.0, \u003c 3.0.2\"}, {\"status\": \"affected\", \"version\": \"\u003e= 4.0.0, \u003c 4.0.1\"}]}], \"references\": [{\"url\": \"https://github.com/plone/plone.app.textfield/security/advisories/GHSA-4r4f-gg25-rmg5\", \"name\": \"https://github.com/plone/plone.app.textfield/security/advisories/GHSA-4r4f-gg25-rmg5\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/plone/plone.app.textfield/commit/0da1aeec2406cf640977eb857a03e792d2c7cac2\", \"name\": \"https://github.com/plone/plone.app.textfield/commit/0da1aeec2406cf640977eb857a03e792d2c7cac2\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/plone/plone.app.textfield/commit/467638e500d804c637031387a227a2b02d12a86f\", \"name\": \"https://github.com/plone/plone.app.textfield/commit/467638e500d804c637031387a227a2b02d12a86f\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/plone/plone.app.textfield/commit/781d517a38524087fe57525a94806684908f852f\", \"name\": \"https://github.com/plone/plone.app.textfield/commit/781d517a38524087fe57525a94806684908f852f\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored RichText value when mimeType equals outputMimeType, including values that claim the text/x-html-safe output type. This equality shortcut bypasses the safe_html transform even though the transform itself correctly removes event-handler attributes and unsafe URI schemes. Equal types can result from a RichText field configured with the same mimeType and outputMimeType or from REST API input that supplies text/x-html-safe as its content type. The raw stored value is then emitted through tal:content=structure without escaping, allowing a user who can set a RichText field to store JavaScript that executes in a viewer\u0027s browser. This issue is fixed in versions 2.0.2, 3.0.2, and 4.0.1.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-80\", \"description\": \"CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-09-15T16:38:38.290Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-54503\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-15T19:02:18.109Z\", \"dateReserved\": \"2026-06-15T18:01:15.512Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-09-15T16:38:38.290Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-54503

Vulnerability from fkie_nvd - Published: 2026-09-15 17:17 - Updated: 2026-09-15 19:17

Severity

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/plone/plone.app.textfield/commit/0da1aeec2406cf640977eb857a03e792d2c7cac2
	security-advisories@github.com	https://github.com/plone/plone.app.textfield/commit/467638e500d804c637031387a227a2b02d12a86f
	security-advisories@github.com	https://github.com/plone/plone.app.textfield/commit/781d517a38524087fe57525a94806684908f852f
	security-advisories@github.com	https://github.com/plone/plone.app.textfield/security/advisories/GHSA-4r4f-gg25-rmg5

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "plone.app.textfield",
          "vendor": "plone",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.0.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored RichText value when mimeType equals outputMimeType, including values that claim the text/x-html-safe output type. This equality shortcut bypasses the safe_html transform even though the transform itself correctly removes event-handler attributes and unsafe URI schemes. Equal types can result from a RichText field configured with the same mimeType and outputMimeType or from REST API input that supplies text/x-html-safe as its content type. The raw stored value is then emitted through tal:content=structure without escaping, allowing a user who can set a RichText field to store JavaScript that executes in a viewer\u0027s browser. This issue is fixed in versions 2.0.2, 3.0.2, and 4.0.1."
    }
  ],
  "id": "CVE-2026-54503",
  "lastModified": "2026-09-15T19:17:20.483",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54503",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-15T19:02:07.172464Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-15T17:17:21.060",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/plone/plone.app.textfield/commit/0da1aeec2406cf640977eb857a03e792d2c7cac2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/plone/plone.app.textfield/commit/467638e500d804c637031387a227a2b02d12a86f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/plone/plone.app.textfield/commit/781d517a38524087fe57525a94806684908f852f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/plone/plone.app.textfield/security/advisories/GHSA-4r4f-gg25-rmg5"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-80"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-4R4F-GG25-RMG5

Vulnerability from github – Published: 2026-07-17 18:35 – Updated: 2026-07-17 18:35

Summary

plone.app.textfield: Stored XSS by spoofing mime type

Details

Impact

A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type (text/x-html-safe) is the type that signifies "already sanitized", any value whose stored mimeType equals it bypasses the safe_html transform entirely on render. The transform itself is sound — it correctly strips on* event-handler attributes and javascript:/data: URIs; the defect is that it is never invoked for these values. The unsanitized value is then emitted via tal:content="structure ...", which performs no escaping, so the payload executes in the viewer's browser.

This can be a problem when a RichText field is wrongly defined in code with a mimeType and outputMimeType that are the same, or when the REST API is used to the same effect.

Patches

The problem has been patched:

For Plone 6.0, upgrade plone.app.textfield to 2.0.2.
For Plone 6.1, upgrade plone.app.textfield to 3.0.2.
For Plone 6.2, upgrade plone.app.textfield to 4.0.1.

Workarounds

There is no known workaround.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "plone.app.textfield"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "plone.app.textfield"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "plone.app.textfield"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.0.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54503"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-80"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-17T18:35:57Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nA stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type (`text/x-html-safe`) is the type that signifies \"already sanitized\", any value whose stored mimeType equals it bypasses the safe_html transform entirely on render. The transform itself is sound \u2014 it correctly strips `on*` event-handler attributes and `javascript:/data:` URIs; the defect is that it is never invoked for these values. The unsanitized value is then emitted via `tal:content=\"structure ...\"`, which performs no escaping, so the payload executes in the viewer\u0027s browser. \n\nThis can be a problem when a RichText field is wrongly defined in code with a `mimeType` and `outputMimeType` that are the same, or when the REST API is used to the same effect.\n\n### Patches\nThe problem has been patched:\n\n* For Plone 6.0, upgrade `plone.app.textfield` to 2.0.2.\n* For Plone 6.1, upgrade `plone.app.textfield` to 3.0.2.\n* For Plone 6.2, upgrade `plone.app.textfield` to 4.0.1.\n\n### Workarounds\nThere is no known workaround.",
  "id": "GHSA-4r4f-gg25-rmg5",
  "modified": "2026-07-17T18:35:57Z",
  "published": "2026-07-17T18:35:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/plone/plone.app.textfield/security/advisories/GHSA-4r4f-gg25-rmg5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/plone/plone.app.textfield"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "plone.app.textfield: Stored XSS by spoofing mime type "
}

PYSEC-2026-3497

Vulnerability from pysec - Published: 2026-07-23 11:41 - Updated: 2026-07-23 14:32

Details

Impact

This can be a problem when a RichText field is wrongly defined in code with a mimeType and outputMimeType that are the same, or when the REST API is used to the same effect.

Patches

The problem has been patched:

For Plone 6.0, upgrade plone.app.textfield to 2.0.2.
For Plone 6.1, upgrade plone.app.textfield to 3.0.2.
For Plone 6.2, upgrade plone.app.textfield to 4.0.1.

Workarounds

There is no known workaround.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Impacted products

Name	purl
plone-app-textfield	pkg:pypi/plone-app-textfield

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "plone-app-textfield",
        "purl": "pkg:pypi/plone-app-textfield"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.2"
            },
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.0.2"
            },
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0",
        "1.0.1",
        "1.0.2",
        "1.0b1",
        "1.0b2",
        "1.0b3",
        "1.0b4",
        "1.0b5",
        "1.0b6",
        "1.0b7",
        "1.1",
        "1.2",
        "1.2.1",
        "1.2.10",
        "1.2.11",
        "1.2.12",
        "1.2.2",
        "1.2.3",
        "1.2.4",
        "1.2.5",
        "1.2.6",
        "1.2.7",
        "1.2.8",
        "1.2.9",
        "1.3.0",
        "1.3.1",
        "1.3.2",
        "1.3.3",
        "1.3.4",
        "1.3.5",
        "1.3.6",
        "1.3.7",
        "2.0.0",
        "2.0.1",
        "3.0.0",
        "3.0.1",
        "4.0.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54503",
    "GHSA-4r4f-gg25-rmg5"
  ],
  "details": "### Impact\n\nA stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type (`text/x-html-safe`) is the type that signifies \"already sanitized\", any value whose stored mimeType equals it bypasses the safe_html transform entirely on render. The transform itself is sound \u2014 it correctly strips `on*` event-handler attributes and `javascript:/data:` URIs; the defect is that it is never invoked for these values. The unsanitized value is then emitted via `tal:content=\"structure ...\"`, which performs no escaping, so the payload executes in the viewer\u0027s browser. \n\nThis can be a problem when a RichText field is wrongly defined in code with a `mimeType` and `outputMimeType` that are the same, or when the REST API is used to the same effect.\n\n### Patches\nThe problem has been patched:\n\n* For Plone 6.0, upgrade `plone.app.textfield` to 2.0.2.\n* For Plone 6.1, upgrade `plone.app.textfield` to 3.0.2.\n* For Plone 6.2, upgrade `plone.app.textfield` to 4.0.1.\n\n### Workarounds\nThere is no known workaround.",
  "id": "PYSEC-2026-3497",
  "modified": "2026-07-23T14:32:25.443333Z",
  "published": "2026-07-23T11:41:46.855463Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/plone/plone.app.textfield/security/advisories/GHSA-4r4f-gg25-rmg5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/plone/plone.app.textfield"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/plone-app-textfield"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-4r4f-gg25-rmg5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54503"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "plone.app.textfield: Stored XSS by spoofing mime type "
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-54503 (GCVE-0-2026-54503)

FKIE_CVE-2026-54503

GHSA-4R4F-GG25-RMG5

Impact

Patches

Workarounds

PYSEC-2026-3497

Impact

Patches

Workarounds

Tags

Sightings

Nomenclature

Related by attack behaviour