Description
Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the (1) statusmessages or (2) linkintegrity module, which the module unpickles and executes.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | zope-cmfplone | 2.5.1-4etch1 | DSA-1405-2, DSA-1405-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | plone | >= 2.5, < 2.5.5 | 2.5.5 | GHSA-hf26-vvmx-x8c8 |
| PyPI | plone | >= 3.0, < 3.0.3 | 3.0.3 | GHSA-hf26-vvmx-x8c8 |
| PyPI | plone | >= 2.5, < 2.5.5 · >= 3.0, < 3.0.3 | 2.5.5, 3.0.3 | PYSEC-2007-4 |
Advisories 2
- DSA-1405-1 zope-cmfplone - arbitrary code Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1405-2 zope-cmfplone - arbitrary code Debian Security (DSA / DLA) · Mar 9, 2026
References
- plone-pythoncode-execution(38288) vdb-entry
- 42071 vdb-entry
- 26354 vdb-entry
- 27559 third-party-advisory
- 27530 third-party-advisory
- 20071106 [CVE-2007-5741] Plone: statusmessages and linkintegrity unsafe network data hotfix mailing-list
- DSA-1405 vendor-advisory
- ADV-2007-3754 vdb-entry
- http://plone.org/about/security/advisories/cve-2007-5741
- 42072 vdb-entry