PT-2026-60894 · Plone · Plone-App-Textfield+1

CVE-2026-54503 · Published 2026-07-17 · Updated 2026-07-23

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions plone.app.textfield versions prior to 2.0.2 plone.app.textfield versions prior to 3.0.2 plone.app.textfield versions prior to 4.0.1

Description A stored Cross-Site Scripting (XSS) issue affects RichText fields. The RichTextValue.output function returns the raw, unsanitized stored value when the stored mimeType equals the outputMimeType. Specifically, if the stored mimeType is text/x-html-safe, the system assumes the content is already sanitized and bypasses the safe html transform during rendering. This allows unsanitized values to be emitted via tal:content="structure ..." without escaping, leading to payload execution in the viewer's browser. This occurs when a RichText field is incorrectly defined in code with identical mimeType and outputMimeType values, or when the REST API is used to achieve the same result.

Recommendations Upgrade plone.app.textfield to 2.0.2 for Plone 6.0. Upgrade plone.app.textfield to 3.0.2 for Plone 6.1. Upgrade plone.app.textfield to 4.0.1 for Plone 6.2.

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2026-54503

GHSA-4R4F-GG25-RMG5

PYSEC-2026-3497

Affected Products

Plone

Plone-App-Textfield

References · 7

• https://osv.dev/vulnerability/GHSA-4r4f-gg25-rmg5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54503 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-3497 · Vendor Advisory
• https://github.com/plone/plone.app.textfield · Note
• https://github.com/plone/plone.app.textfield/security/advisories/GHSA-4r4f-gg25-rmg5 · Note
• https://pypi.org/project/plone-app-textfield · Note
• https://github.com/advisories/GHSA-4r4f-gg25-rmg5 · Note