Plone RCE chain via CMFEditions modifier and allow_module sandbox escapes — anonymous attackers can run code on server
Severity: critical · Patch status: patched · Since 2026-11-11
On 2026-11-10 the Plone/Zope Security Team released fixes for a remote code execution chain affecting all supported Plone versions (6.0, 6.1, 6.2) and older versions back to at least 4.3. The chain combines missing security declarations on CMFEditions portalmodifier classes (letting anonymous users edit and run TALES conditions, even with editor privileges), overly broad allowmodule declarations in Products.CMFPlone, Products.MimetypesRegistry and plone.batching that expose imported modules like os to restricted code, and plone.restapi exposing the json module to bypass permissions. Reported by Mokrane ABDELMALEK via Ghent University VDP. Fixes are available as updated packages for Plone 6.x or the Products.PloneHotfix20261110 hotfix for 4.3–6.2. CVEs pending. Administrators should check for modified modifier conditions indicating prior compromise.
What to do
- Update to the fixed package versions for your Plone series, or install Products.PloneHotfix20261110 and restart all Zope instances
- Block URLs containing portal_modifier at the web server as a workaround and keep it after updating
- Check for attacks: use @@check-modifier-conditions as Manager, or review hotfix startup logs for 'POSSIBLE ATTACK: MODIFIED VERSIONING CONDITIONS FOUND'; treat unrecognized conditions as compromise
- Review custom Python Scripts/templates for imports now blocked, declaring needed names via ModuleSecurityInfo rather than allow_module
- Upgrade out-of-support Plone 5.2 and older to Plone 6
Fixed versions
- Products.CMFPlone 6.2.3/6.1.6/6.0.16
- Products.CMFEditions 5.0.2/4.0.7
- Products.MimetypesRegistry 4.0.2/3.0.2
- plone.batching 3.0.3/2.0.8
- plone.restapi 10.2.1/9.15.8
- Products.PloneHotfix20261110 (Plone 4.3–6.2)
Sources
All live incidents on Threat Watch
