EUVD-2026-84980
GHSA-5426-92w4-wvhv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as content-creator
-
DeliveryCreate content with oversized title/description/filename
-
ExploitOversized values stored unbounded
-
ExecutionFields rendered across listings/nav/ZMI
-
ImpactSite becomes unresponsive, item hard to edit/delete
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Plone user who holds permission to create or edit Dexterity-based content (via plone.app.dexterity IBasic behavior or plone.app.contenttypes file types); the attacker submits a content item with an excessively long title, description, or uploaded-file name. Exploitation is limited to the affected version ranges (plone.app.dexterity through 3.2.2, 4.0.0-4.1.2, 5.0.0; plone.app.contenttypes through 3.0.11, 4.0.0-4.0.9, 5.0.0) and is blocked once the max_length constraints from the patched releases are applied. The practical limiting factor is the PR:L authentication requirement - sites without open self-registration restrict this to trusted/insider accounts; no user interaction by a victim is needed. |
| Impact | This is a genuine but low-priority availability issue, not a high-severity emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5 MEDIUM) is internally consistent with the description: a remote, low-privileged (authenticated content-creating) user triggers an availability-only impact with no confidentiality or integrity loss, matching CWE-400 (uncontrolled resource consumption). The source-code evidence confirms the mechanism precisely - before the patch, title/description/filename fields were unbounded, and the fix (config.py MAX_TITLE_LENGTH=1024, MAX_DESCRIPTION_LENGTH=10000, plus filename truncation to 1024) adds schema max_length constraints because these fields are rendered repeatedly in listings, navigation, and the ZMI. No EPSS score, KEV listing, POC, or SSVC data was supplied; per the precision rule this is 'no public exploit identified at time of analysis.' The key limiter is PR:L - an attacker must already hold an authenticated account with permission to create/edit content, which sharply narrows realistic exploitation to insiders or environments with open/self-registration. There are no conflicting signals: the CVSS vector, description, and commit diffs all agree the impact is degraded/denied availability, not code execution or data exposure. |
| Exploit ScenarioDerived | An authenticated user with content-creation rights on a Plone site creates a Dexterity content item (or uploads a file) with an extremely long title, description, or filename (e.g., thousands of characters). Because these values are rendered in listings, navigation, and the management interface, pages that include the item become slow or unresponsive, and the offending content can itself become difficult to edit or delete, degrading availability. No public exploit code is identified; the fix commits include regression tests demonstrating the oversized-input condition. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Denial of service in Plone's Dexterity content system lets an authenticated user with content-creation rights submit items carrying excessively long titles, descriptions, or uploaded-file names, rendering the site unresponsive and leaving the resulting content hard to edit or delete. The flaw affects plone.app.dexterity through 3.2.2, 4.0.0-4.1.2 and 5.0.0, and plone.app.contenttypes through 3.0.11, 4.0.0-4.0.9 and 5.0.0, and carries a CVSS v3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because the AV:N vector still requires a valid low-privileged account. At the time of analysis there is no public exploit code and no confirmed active exploitation (not in CISA KEV); the practical risk is highest on sites that permit open self-registration or grant content-editing permissions broadly to untrusted users, while the patched releases strictly cap field lengths.
RemediationAI
Upgrade both add-ons to a patched release on the matching maintenance branch: plone.app.dexterity 3.2.3, 4.1.3, or 5.0.1, and plone.app.contenttypes 3.0.12, 4.0.10, or 5.0.1 (vendor advisories https://github.com/plone/plone.app.dexterity/security/advisories/GHSA-5426-92w4-wvhv and https://github.com/plone/plone.app.contenttypes/security/advisories/GHSA-8pcw-h6w9-h46g). If you cannot patch immediately, note that the only prerequisite is a low-privileged authenticated account with content-creation or editing rights, so the effective compensating control is to shrink that population: disable open self-registration, tighten the Contributor/Editor role assignments, and audit which roles hold Add portal content, accepting the trade-off that legitimate authors lose convenient self-service accounts. Administrators can also override the new limits at deployment time via IBasic["title"].max_length and IBasic["description"].max_length, but only after applying the patched code, since the vulnerable versions enforce no limit at all. Do not attempt to mitigate by blocking ports or disabling HTTP methods - the attack is a normal authenticated content-submission request, and there is no network-level signature. After patching, review existing content for oversized titles, descriptions, and filename-derived titles, since already-stored values are not automatically truncated and will continue to slow listings until edited or removed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in pypi, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-400 (Uncontrolled Resource Consumption). Plone's Dexterity content-type framework defines the IBasic behavior in plone.app.dexterity, whose title and description fields are zope.schema TextLine/Text values with no max_length constraint; plone.app.contenttypes adds subscriber logic that copies an uploaded file's filename into the object's title. Because these fields are rendered in folder listings, navigation trees, and the Zope Management Interface (ZMI), and because they are stored in the ZODB and frequently re-serialized, arbitrarily large values impose a multiplicative performance penalty across many pages rather than a single request. Long values also generate correspondingly long content identifiers and breadcrumbs, which is why the advisory notes the content becomes difficult to edit or remove afterward. The upstream fix introduces plone/app/dexterity/config.py with MAX_TITLE_LENGTH = 1024 and MAX_DESCRIPTION_LENGTH = 10000, applies title/description max_length to the IBasic schema, and truncates filename-derived titles to MAX_TITLE_LENGTH in both plone.app.dexterity's filename behavior and plone.app.contenttypes' set_title_description subscriber (with a defensive fallback of 1024 if the config import fails). Test coverage in the fix confirms validation now raises zope.schema ValidationError above 1025/10001 characters and that the limits remain developer-overridable via IBasic["title"].max_length. Note that Zope already restricted the generated content id to 255 characters; the vulnerability stems from the unbounded title/description metadata, not the id.
Know when Plone gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable web CMS action requiring a low-privileged authenticated content-creator (PR:L), trivially performed (AC:L), yielding availability-only impact (A:H, C/I:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
plone.app.dexterity is a content-type system for the Plone content management system, and plone.app.contenttypes provides Plone’s Dexterity-based content types. Plone.app.dexterity versions through 3.2.2, 4.0.0 through 4.1.2, and 5.0.0, and plone.app.contenttypes versions through 3.0.11, 4.0.0 through 4.0.9, and 5.0.0 are vulnerable to denial of service because an authenticated user can create content with excessively long titles, descriptions, or uploaded-file names, causing Plone to become unresponsive and potentially making the resulting content difficult to edit or delete. The vulnerability is patched in plone.app.dexterity versions 3.2.3, 4.1.3, and 5.0.1, and in plone.app.contenttypes versions 3.0.12, 4.0.10, and 5.0.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution du
Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone bef
Zope is an open-source web application server. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitabl
The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allowing unauthenticated
The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x t
An issue in Plone Docker Official Image 5.2.13 (5221) open-source software allows for remote code execution via improper
z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting (
Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through
Cross-site scripting (XSS) vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3
Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through
Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow
Arbitrary server-side code execution in the Plone process is possible through the Classic portlet shipped in plone.app.p
Exploit-DB