Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection

Fix availableCritical · CVSS 9.9EPSS 0.64%

Published Sep 23, 2026 · updated Sep 23, 2026

What to do

  1. Upgrade to a fixed version: plone.app.portlets 7.0.2, plone.app.portlets 6.0.4, plone.app.portlets 5.0.8.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIplone.app.portlets8,049 downloads/week

Vulnerable versions
>= 7.0.0, <= 7.0.1
Fixed in
7.0.2

Check your project: pip show plone.app.portlets

PyPIplone.app.portlets8,049 downloads/week

Vulnerable versions
>= 6.0.0, <= 6.0.3
Fixed in
6.0.4

Check your project: pip show plone.app.portlets

PyPIplone.app.portlets8,049 downloads/week

Vulnerable versions
>= 5.0.0, <= 5.0.7
Fixed in
5.0.8

Check your project: pip show plone.app.portlets

Sources

CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

← All critical vulnerabilities