External risk intelligence

Plone iCalendar Import Vulnerability Allows Internal Network Access Resource Exhaustion and Cross-Site Scripting

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-55247

The vulnerability resides in a CMS component that processes iCalendar data. Exploitation requires an authenticated user with editor privileges to trigger the import functionality. While the attack vector is network-based, the necessity for authenticated access significantly reduces the attack surface compared to services accessible to unauthenticated internet users.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in the event management component of Plone, which handles iCalendar imports. If exploited, an authenticated user could potentially access internal network resources, disrupt site availability, or execute scripts within another user's browser. The main concern is confirming relevance and exposure within your Plone instances.

Event imports allow unauthorized access or disruption.
A logged-in editor can trigger a severe security risk.
Confirm Plone event import usage and apply updates.

Attack Path

How an attacker could exploit the issue

An attacker with logged-in editor privileges can exploit this vulnerability by importing a malicious iCalendar file. This allows them to craft an event that makes the server request internal network resources, consume all available server resources to cause a denial-of-service, or execute scripts in other users' browsers.

Logged-in editor access required.
Import malicious iCalendar events.
Server compromise and cross-user scripting.

Live Threat

Current exploitation, exposure, and threat context

A logged-in editor could cause the server to request internal network resources or local files, potentially leading to denial-of-service conditions or script execution in other users' browsers when importing calendar data.

Internal network resources or local files could be accessed.
Malicious event URLs could be stored.
Service could be taken offline.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership for this vulnerability likely falls to the Plone application owners and the infrastructure or platform teams managing the Plone instances. The first practical step is to inventory all Plone instances, confirm which ones are accessible externally or host business-critical data, identify the specific owner for each instance, and then prioritize remediation based on the identified risk and exposure.

Application owners should manage the issue.
Verify Plone instance accessibility and criticality.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is plone.app.event?

It is a specialized add-on component for the Plone content management system. It provides the core functionality needed to create and manage calendar-based event content types. Developers and site administrators use it to allow users to organize, share, and track scheduled activities directly within their Plone websites.

How does CVE-2026-55247 represent a weakness?

This vulnerability is classified as CWE-400, or uncontrolled resource consumption. In the context of CVE-2026-55247, the iCalendar import feature fails to properly restrict incoming data sizes or validate network requests. This allows an attacker to force the server to work excessively, potentially exhausting system resources and causing the application to stop responding.

When does this vulnerability trigger?

The flaw triggers when an authenticated editor imports a specifically crafted malicious iCalendar file or URL. Simply viewing the site or browsing existing calendars without performing an import operation does not trigger the vulnerability. The issue requires the active misuse of the event import functionality to initiate unauthorized internal network requests or resource spikes.

Is my site at risk?

Halo Surface Signal identifies this as a potential risk because the vulnerability exists in a common CMS component, yet it requires authenticated editor privileges to initiate. While the attack is network-based, the necessity of logged-in access means your risk level depends heavily on the security of your editor accounts and who you have granted administrative permissions.

How do I fix this in Plone?

You should update your Plone environment to versions 5.2.4 or 6.0.1, which contain the necessary patches. These updates introduce strict limits on the size of imported files and the number of events processed, while also adding mandatory validation for all calendar URLs to prevent unauthorized requests.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.