CVE-2026-55248

CRITICALPre-NVD 9.19.1—
EchelonGraph scoreMEDIUM confidence

This critical-severity CVE scores 9.1 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit probability: 0.3%, top 76% of all CVEs by exploit prediction. GitHub Security Advisory data not yet ingested — confidence will rise once GHSA publishes (typical lag: hours to days for open-source ecosystem CVEs; never for infrastructure-only CVEs).

Triggered by: NVD CVSS baseline
Sources: epss, secondary
9.1EG
EchelonGraph verdictPlan a fixSerious severity, but no confirmed exploitation yet.
  • High severity, but no confirmed exploitation yet
CISA-KEV: Not listedEPSS PROB: 0%CVSS: 9.1Exploit: None knownExposed: 0

No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.

plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portlets/rss.py to download and retain excessive data in memory and deny service. The same RSS URL handling accepts internal hosts, IP addresses, single-word domains, and explicit ports, allowing server-side requests that can probe internal network services and open ports. A malicious feed item can also supply a JavaScript URL that is retained as the item link and can execute script when used by a victim. The affected logic includes _rss_feed_url_validator, _normal_url_validator, RSSFeed._retrieveFeed, RSSFeed._buildItemDict, and the FEED_DATA in-memory cache. This issue is fixed in versions 5.0.8, 6.0.4, and 7.0.2.

CVSS v3
9.1
EG Score
9.1(medium)
EG Risk
41(Track)
EG Risk 41/100SSVC: Track

EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).

How it’s computed
Severity91% × 45%
Exploitation0% × 40%
Automatability0% × 15%
Action: Routine — remediate on your standard cadence.
EPSS PROB
0%
EPSS %ILE
24%
KEV
Not listed

Published

August 28, 2026

Last Modified

August 28, 2026

Advisory Details (5)

Auto-updated Aug 29, 2026
Patch available. Sources: github_commit, github.
github Patch Available

Denial of service via RSS feed portlet · Advisory · plone/plone.app.portlets · GitHub

https://github.com/plone/plone.app.portlets/security/advisories/GHSA-x5g3-w747-2h8q
github_commit

commit df5e256baee5 (plone/plone.app.portlets)

Fix landed in plone/plone.app.portlets commit df5e256baee5 — awaiting tagged release

https://github.com/plone/plone.app.portlets/commit/df5e256baee55083cbd6b9a2623675d4cb26b6cd
github_commit

commit a3b2c2887165 (plone/plone.app.portlets)

Fix landed in plone/plone.app.portlets commit a3b2c2887165 — awaiting tagged release

https://github.com/plone/plone.app.portlets/commit/a3b2c2887165b308cd915cbb87b8276f90a76680
github_commit

commit 9f16b6fb1021 (plone/plone.app.portlets)

Fix landed in plone/plone.app.portlets commit 9f16b6fb1021 — awaiting tagged release

https://github.com/plone/plone.app.portlets/commit/9f16b6fb10211916686c6c346ea174bf517e3fbd
github_commit

commit 09da52ef7b29 (plone/plone.app.portlets)

Fix landed in plone/plone.app.portlets commit 09da52ef7b29 — awaiting tagged release

https://github.com/plone/plone.app.portlets/commit/09da52ef7b297daa8e0cfd2361e47c37d9b073ad

Vendor Advisories for CVE-2026-55248(1)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Weakness Classification(1)

MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.

Data Freshness Timeline

(refreshed 6× in last 7d / 6× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

  1. 2026-08-30 02:53 UTCEG score recompute
  2. 2026-08-30 01:22 UTCEPSS rescore
  3. 2026-08-28 22:44 UTCEG score recompute
  4. 2026-08-28 22:09 UTCEG score recompute
  5. 2026-08-28 20:24 UTCEG score recompute
  6. 2026-08-28 19:10 UTCEG score recompute

Related CVEs(same CWE)

Frequently asked(5)

What is CVE-2026-55248?
CVE-2026-55248 is a critical vulnerability published on August 28, 2026. plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portlets/rss.py to download and retain excessive data in…
When was CVE-2026-55248 disclosed?
CVE-2026-55248 was first published in the National Vulnerability Database on August 28, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2026-55248 actively exploited?
CVE-2026-55248 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 0% probability of exploitation in the next 30 days, which ranks it in the top 75.8% of all scored CVEs.
What is the CVSS score of CVE-2026-55248?
CVE-2026-55248 has a CVSS v3 base score of 9.1 (NVD).
How do I remediate CVE-2026-55248?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-55248, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

Explore the affected products and dependency analysis for CVE-2026-55248

Explore →

Is Your Infrastructure Affected by CVE-2026-55248?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs