CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Plone

product · product:plone single-source

Coverage
1
first 2026-11-12 → last 2026-11-12
Latest activity
2026-11-12
Plone anonymous RCE chain: update or install the 20261110 hotfix, block portal_modifier, check modifier…
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
3
2 hosts

Action items (1)

Do-now tasks recorded on the entries about Plone, newest first. Check the date before acting on an older one.

  • On every Plone site, update to CMFPlone 6.2.3, 6.1.6 or 6.0.16 with the helper packages the Plone team lists, or install Products.PloneHotfix20261110 on any version from 4.3 to 6.2, restart all Zope instances, keep blocking URLs that contain portal_modifier at the front web server, and then check the modifier conditions with @@check-modifier-conditions or the hotfix's startup warning, because an anonymous request can already have stored a malicious condition that survives the fix.
    2026-11-12Plone anonymous RCE chain: update or install the…

Defender insights

What each entry about Plone tells a defender to do, newest first.

2026-11-12NOTABLEPlone anonymous RCE chain: update or install the 20261110 hotfix, block portal_modifier, check modifier conditions

Exposure · detection

Story timeline

  1. 2026-11-12Plone security fix of 2026-11-10: a chain of missing security declarations and opened modules lets an anonymous visitor run code on the server in every supported Plone version and back to 4.3; a working proof of concept exists, no CVE ids yet, no exploitation reported
    trending-vulnerabilitiesPlone anonymous RCE chain: update or install the 20261110 hotfix, block portal_modifier, check modifier conditions

Hunting pivots

Releases covered
Plone
Tags
patch-availablepre-authrcevulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ExecutionCommand and Scripting Interpreter: Python

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-11-12/plone-security-hotfix-20261110-anonymous-rce-chain · ATT&CK page ↗

Execution TA0002

T1059.006Command and Scripting Interpreter: Python×1

Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the <code>python.exe</code> interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.

Evidence: 2026-11-12/plone-security-hotfix-20261110-anonymous-rce-chain · ATT&CK page ↗

Entries about Plone (1)

2026-11-12 · view entry permalink →

NOTABLENATOA2

Plone security fix of 2026-11-10: a chain of missing security declarations and opened modules lets an anonymous visitor run code on the server in every supported Plone version and back to 4.3; a working proof of concept exists, no CVE ids yet, no exploitation reported

The Plone and Zope security team says the fixes it released on 2026-11-10 close a chain of several issues that together let an anonymous visitor run code on the server, in all supported Plone versions (6.0, 6.1 and 6.2) and in older ones back to at least 4.3 (Plone Security Team, 2026-11-10). The anonymous entry point is Products.CMFEditions: the conditional modifiers in portal_modifier had no security declarations, so an anonymous visitor could change a modifier's TALES condition and then run it, and the condition is also evaluated when an editor saves versioned content (Plone Security Team, 2026-11-10). Products.CMFPlone, Products.MimetypesRegistry and plone.batching opened whole modules to restricted code, which let TALES expressions and Python scripts escape the sandbox and reach modules such as os, and plone.restapi opened the json module (Plone Security Team, 2026-11-10). The CMFEditions advisory rates its flaw 9.8 with no privileges required and states that a working proof of concept exists; the team says details are public and that with current AI tools it may not take long to turn them into a working exploit, and no source reports exploitation (Plone, 2026-11-10; Plone Security Team, 2026-11-10).

The fixed packages are CMFPlone 6.2.3, 6.1.6 and 6.0.16 with the helper package versions the announcement lists, or the hotfix Products.PloneHotfix20261110, which covers Plone 4.3 to 6.2, and all Zope instances must be restarted afterwards (Plone Security Team, 2026-11-10). The team's pre-announcement of 2026-11-02 already gave the workaround, to block any URL containing portal_modifier at the web server at any path depth, which only helps if Zope's own port cannot be reached directly; the team advises keeping it after updating (Plone Security Team, 2026-11-02). After the fix, restricted code can import only the names Plone itself needs from the closed modules, so custom scripts that import others now get an Unauthorized error (Plone Security Team, 2026-11-10).

It is a chain of several issues, which together let an anonymous visitor run code on the server.

Plone Security Team 2026-11-10

A working proof of concept exists.

Plone (GitHub Security Advisory, Products.CMFEditions) 2026-11-10

A changed modifier condition stays in the database, also after you install the fix.

Plone Security Team 2026-11-10
vulnerability12 Nov 04:12Zsingle-sourceOpen finding →
Sources: Plone Security Team · Plone (GitHub Security Advisory, Products.CMFEditions)

explore in graph

Where this entity is cited

  • Vulns1

Source distribution

  • community.plone.org2 (67%)
  • github.com1 (33%)
All cited sources (3)