https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T21:14:54.531181+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-274812 EUVD-2026-274812 2026-10-03T21:14:54.595466+00:00 EUVD-2026-274812 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28413 fkie_cve-2026-28413 2026-10-03T21:14:54.595504+00:00

Products.isurlinportal is a replacement for isURLInPortal method in Plone. Prior to versions 2.1.0, 3.1.0, and 4.0.0, a url /login?came_from=////evil.example may redirect to an external website after login. This issue has been patched in versions 2.1.0, 3.1.0, and 4.0.0.

 https://cve.radiocsirt.org/vuln/ghsa-43gx-6gv6-3jcp GHSA-43gx-6gv6-3jcp — Products.isurlinportal has possible open redirect when using more than 2 forward slashes 2026-10-03T21:14:54.595537+00:00

Affected: PyPI: Products.isurlinportal, PyPI: products-isurlinportal

### Impact A url `/login?came_from=////evil.example` may redirect to an external website after login.

Standard Plone is not affected, but if you have customised the login, for example with add-ons, you might be affected. You can try the url to check if you are affected or not.

### Patches The problem has been patched in `Products.isurlinportal`.

* Plone 6.2: upgrade to `Products.isurlinportal` 4.0.0. * Plone 6.1: upgrade to `Products.isurlinportal` 3.1.0. * Plone 6.0: upgrade to `Products.isurlinportal` 2.1.0. * Older Plone versions don't have security support anymore.

### Workarounds There are no known workarounds.

### Background When you are anonymous and land on a page that requires a login, Plone sends you to the login form. After successful login, Plone redirects you back to the page you came from. Various other forms and pages have a similar system.

This could get abused by an attacker to trick Plone into redirecting to a different website. Plone checks the page that would be redirected to. It is only accepted if it is within the Plone site domain or part of a different trusted domain.

The main check for this is in the `Products.isurlinportal` package. A lot of potentially malicious urls are already safely rejected, but here a loop hole was found.

This was discovered during a penetration test by the CERT-EU Team.

 https://cve.radiocsirt.org/vuln/pysec-2026-112 PYSEC-2026-112 2026-10-03T21:14:54.595579+00:00

Affected: PyPI: products-isurlinportal

Products.isurlinportal is a replacement for isURLInPortal method in Plone. Prior to versions 2.1.0, 3.1.0, and 4.0.0, a url /login?came_from=////evil.example may redirect to an external website after login. This issue has been patched in versions 2.1.0, 3.1.0, and 4.0.0.