Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-54503— plone.app.textfield: Stored XSS by spoofing mime type

Quick assessment

Affected
plone plone.app.textfield
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

提供了一个名为 的 Zope schema 风格字段类型，用于存储带有相关 MIME 类型的值。在 2.0.2、3.0.2 和 4.0.1 之前（视具体版本线而定），当 等于 时， 会直接返回未净化的已存储 值，包括那些声明为 输出类型的值。这种类型相等的快捷路径绕过了 转换，尽管该转换本身能够正确移除事件处理程序属性和不安全的 URI 协议。类型相等可能由配置了相同 和 的 字段引起，或者由 REST API 输入将 作为其内容类型提供所致。随后，原始存储值通过 无转义地输出，使得能够设置 字段的用户可以存储 J

CVSS 4.3 · Medium

Possible ATT&CK Techniques 1 AI

T1059.007 · JavaScript

Affected Version Matrix 3

VendorProduct Version RangeStatus
plone plone.app.textfield < 2.0.2 affected
>= 3.0.0, < 3.0.2 affected
>= 4.0.0, < 4.0.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54503

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
plone.app.textfield: Stored XSS by spoofing mime type
Source: CVE Program / CVE List V5
Vulnerability Description
plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored RichText value when mimeType equals outputMimeType, including values that claim the text/x-html-safe output type. This equality shortcut bypasses the safe_html transform even though the transform itself correctly removes event-handler attributes and unsafe URI schemes. Equal types can result from a RichText field configured with the same mimeType and outputMimeType or from REST API input that supplies text/x-html-safe as its content type. The raw stored value is then emitted through tal:content=structure without escaping, allowing a user who can set a RichText field to store JavaScript that executes in a viewer's browser. This issue is fixed in versions 2.0.2, 3.0.2, and 4.0.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
Web页面中脚本相关HTML标签转义处理不恰当(基本跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
plone plone.app.textfield < 2.0.2 -

II. Public POCs for CVE-2026-54503

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54503

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54503 (3)

Vendor Advisories for CVE-2026-54503 (1)

IV. Related Vulnerabilities

Same vendor: plone
Same weakness: CWE-80

V. Comments for CVE-2026-54503

No comments yet

Leave a comment