🛡️ CVE-2026-54503 — plone-app-textfield

⚪ Unknown ✅ No Known Exploit CWE-80 OSV
N/A
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

plone.app.textfield: Stored XSS by spoofing mime type

Impact

A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type (text/x-html-safe) is the type that signifies "already sanitized", any value whose stored mimeType equals it bypasses the safe_html transform entirely on render. The transform itself is sound — it correctly strips on* event-handler attributes and javascript:/data: URIs; the defect is that it is never invoked for these values. The unsanitized value is then emitted via tal:content="structure ...", which performs no escaping, so the payload executes in the viewer's browser.

This can be a problem when a RichText field is wrongly defined in code with a mimeType and outputMimeType that are the same, or when the REST API is used to the same effect.

Patches

The problem has been patched:

  • For Plone 6.0, upgrade plone.app.textfield to 2.0.2.
  • For Plone 6.1, upgrade plone.app.textfield to 3.0.2.
  • For Plone 6.2, upgrade plone.app.textfield to 4.0.1.

Workarounds

There is no known workaround.

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs low-level privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality low, integrity none, availability none.

Affected software

CVE-2026-54503 is recorded against 1 package.

  • plone-app-textfield (from 4.0.0 up to 4.0.1)

Timeline and source

Published on 17 July 2026 and last revised on 23 July 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

github.com (Web)
github.com (Package)

Details

Severity Unknown
CVSS Score N/A
CVSS Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE CWE-80
Public Exploit ✅ No
Source OSV
Published 2026-07-17
Updated 2026-08-12
Modified 2026-07-23
Fix URL N/A

Affected Packages

Software From version Fixed in
plone-app-textfield 4.0.0 4.0.1

Free Vulnerability Check

Is your site affected by CVE-2026-54503?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against CVE-2026-54503 and other known CVE records.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.