What is the CVSS score of CVE-2026-54503?

CVE-2026-54503 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Which versions of Plone CMS are affected by CVE-2026-54503?

Plone CMS contains a stored cross-site scripting vulnerability (CVSS 4.3) in its textfield and REST API packages that allows authenticated users with upload privileges to inject persistent malicious…. A patch is available.

How to fix or mitigate CVE-2026-54503?

Within 24 hours: audit Plone instances and restrict file-upload permissions to fully trusted internal users; enable comprehensive audit logging for all file operations. Within 7 days: implement server-side MIME type validation to reject files with mismatched headers; deploy Content Security Policy headers restricting script execution (script-src 'self'). Within 30 days: monitor Plone security advisories at plone.org for vendor patch release; execute immediate deployment and conduct forensic audit of all uploaded files for injected content upon patch availability.

Plone CMS CVE-2026-54503

EUVD-2026-78836 MEDIUM

Basic XSS (CWE-80)

2026-06-23

GHSA-4r4f-gg25-rmg5 PYSEC-2026-3497

XSS

4.3

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.4 MEDIUM

Upload requires at least Contributor role (PR:L); victim must view content (UI:R); XSS crosses into victim browser context (S:C); confidentiality and integrity limited to browser-session scope.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Sep 15, 2026 - 17:22 NVD

4.3 (MEDIUM)

Analysis Generated

Jun 23, 2026 - 20:17 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Stored cross-site scripting in Plone CMS enables persistent script injection by spoofing file MIME types within the plone.app.textfield and plone.restapi packages, announced June 5, 2026. An attacker with content-upload access can craft a file whose declared MIME type bypasses Plone's content-type enforcement, causing browsers to render the payload as HTML or JavaScript when other users access the stored content. No public exploit code or CISA KEV listing has been identified at time of analysis; the moderate severity rating (4.3) reflects the stored persistence risk offset by the upload-privilege requirement.

Technical ContextAI

Plone CMS relies on plone.app.textfield for rich-text field storage and transformation, and on plone.restapi to expose a RESTful interface over the same content objects. Both packages handle or expose MIME-typed file and field content. The vulnerability arises from insufficient validation or normalization of the declared MIME type on user-supplied uploads: if the server accepts a caller-supplied content-type without canonicalizing it against the file's actual byte signature, stored content can be later served with a type (e.g., text/html) that causes browsers to execute embedded JavaScript. This is a classic stored-XSS pattern rooted in a missing or bypassable MIME-type validation control - analogous to CWE-79 (Improper Neutralization of Input During Web Page Generation) combined with CWE-434 (Unrestricted Upload of File with Dangerous Type). No formal CWE assignment was provided in the available data.

RemediationAI

Consult the individual GitHub Security Advisories for plone.app.textfield (GHSA-4r4f-gg25-rmg5) and plone.restapi (GHSA-8rqh-vxpr-x77p) to obtain the exact patched versions and apply upgrades via pip. Both packages must be updated - patching only one leaves the other upload path exposed. Exact fixed version numbers are not available from the provided data and must be confirmed in the advisories before deployment. As a compensating control pending patch deployment, restrict file-upload and content-creation permissions to the minimum necessary set of trusted roles (e.g., remove Contributor role from externally-facing or anonymous accounts), which eliminates the attacker's ability to store the spoofed-MIME payload. Additionally, configuring a Content Security Policy (CSP) header that restricts inline script execution can materially reduce XSS impact, though it does not address the root cause. Note that tightening upload permissions may break legitimate contributor workflows.