Skip to main contentSkip to navigationSkip to footer
Plone.org logo

Why Plone

  • What is Plone?
  • Features
  • Plone 6
  • They use Plone
  • Extend Plone
  • Roadmap
  • Plone as a Headless CMS

Why Plone

Get Started with Plone

  • Try Plone
  • Install Plone
  • Documentation
  • Training

Get Started

Services

  • Providers
  • Training

Services

Community

  • Bugs
  • Conferences
  • Contribute
  • Forum
  • Google Summer of Code
  • Online Chat
  • Support
  • Teams

Community

Plone Foundation

  • About the Plone Foundation
  • Board of Directors
  • Membership
  • Meetings
  • How to Sponsor Plone
  • Plone Event and Sprint Sponsorship Policy
  • Copyright, Licensing: Plone Code & Logo
  • Contact us

Foundation

News and Events

  • News
  • Events
  • Podcasts
  • The Plone Newsroom
  • Plone Podcast
  • Plone in Social Media
  • Plone YouTube channel
  • Conferences
  • Sprints
  • Plone Tune-Up Days
  • World Plone Day 2024
  • Plone Conference 2024
  • Join the Plone Newsletter

News and Events
Try now
Home
/
Security
/
Plone Hotfix Descriptions
/
20210518

20210518

Issues fixed

Remote Code Execution via traversal in expressions with aliases
Remote Code Execution via traversal in expressions part 2
Writing arbitrary files via docutils and Python Script
Information disclosures: mostly installation logs
Stored XSS from file upload (svg, html)
Reflected XSS in various spots
XSS vulnerability in CMFDiffTool
Stored XSS from user fullname
Blind SSRF via feedparser accessing an internal URL
Server Side Request Forgery via event ical URL
Server Side Request Forgery via lxml parser
Stored XSS in folder contents
Remote Code Execution via Python Scripts
;
About Plone
Try Plone
Download Plone
Plone Releases
Documentation
Training
Security
Roadmap
GitHub
Community
Forum
Chat
Contribute code
Report an issue
News and events
Conference
Join the Plone newsletter
Foundation
Join the foundation
Board
Donate
Sponsors
Code of conduct
Foundation members
Shop
Follow us
Mastodon
Twitter
Instagram
YouTube
Linkedin
Facebook
Privacy Policy
Cookie settings
Plone.org logo
The text and illustrations in this website are licensed by the Plone Foundation under a Creative Commons Attribution-ShareAlike 4.0 International license. Plone and the Plone® logo are registered trademarks of the Plone Foundation, registered in the United States and other countries. For guidelines on the permitted uses of the Plone trademarks, see https://plone.org/foundation/logo. All other trademarks are owned by their respective owners.