CVE-2026-54503
Received Received - Intake

Stored XSS in Plone RichText Field via Unsanitized Output

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored RichText value when mimeType equals outputMimeType, including values that claim the text/x-html-safe output type. This equality shortcut bypasses the safe_html transform even though the transform itself correctly removes event-handler attributes and unsafe URI schemes. Equal types can result from a RichText field configured with the same mimeType and outputMimeType or from REST API input that supplies text/x-html-safe as its content type. The raw stored value is then emitted through tal:content=structure without escaping, allowing a user who can set a RichText field to store JavaScript that executes in a viewer's browser. This issue is fixed in versions 2.0.2, 3.0.2, and 4.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-54503
EUVD
EUVD-2026-78836

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
plone app_textfield 2.0.2
plone app_textfield 3.0.2
plone app_textfield 4.0.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-80 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the Plone CMS's plone.app.textfield package. It occurs when the RichTextValue.output method returns raw, unsanitized HTML content if the stored MIME type matches the output MIME type, specifically when the output type is text/x-html-safe. This bypasses the safe_html transform that normally sanitizes HTML by removing dangerous attributes and URIs. Attackers can exploit this by injecting malicious scripts that execute in a victim's browser when the content is rendered.

Detection Guidance

Check Plone versions using commands like 'pip show plone.app.textfield' or 'grep -r plone.app.textfield /path/to/plone/install'. Look for versions below 2.0.2, 3.0.2, or 4.0.1 depending on your release line. Inspect RichText fields in Plone for unsanitized HTML content or mismatched mimeType and outputMimeType settings.

Impact Analysis

If you use Plone CMS with the affected versions of plone.app.textfield, an attacker who can set a RichText field could store malicious JavaScript. When other users view the content, the unsanitized script executes in their browsers, potentially stealing session cookies, redirecting to phishing sites, or performing actions on their behalf. The attack requires low privileges and no user interaction.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements for protecting sensitive health information. If exploited, it may result in data breaches, unauthorized data exposure, or loss of data integrity, potentially leading to regulatory penalties and reputational damage.

Mitigation Strategies

Upgrade plone.app.textfield to version 2.0.2 (Plone 6.0), 3.0.2 (Plone 6.1), or 4.0.1 (Plone 6.2) immediately. Avoid configuring RichText fields with matching mimeType and outputMimeType. Review REST API inputs to ensure text/x-html-safe is not misused. No known workaround exists besides patching.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54503. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart