Description
Products.isurlinportal is a replacement for isURLInPortal method in Plone. Prior to versions 2.1.0, 3.1.0, and 4.0.0, a url /login?came_from=////evil.example may redirect to an external website after login. This issue has been patched in versions 2.1.0, 3.1.0, and 4.0.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| plone | Products.isurlinportal | < 4.0.0, < 3.1.0, < 2.1.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | products-isurlinportal | >= 4.0.0a1, < 4.0.0 | 4.0.0 | GHSA-43gx-6gv6-3jcp |
| PyPI | products-isurlinportal | >= 3.0.0, < 3.1.0 | 3.1.0 | GHSA-43gx-6gv6-3jcp |
| PyPI | products-isurlinportal | < 2.1.0 | 2.1.0 | GHSA-43gx-6gv6-3jcp |
| PyPI | products-isurlinportal | < 2.1.0 · >= 3.0.0, < 3.1.0 | 2.1.0, 3.1.0 | PYSEC-2026-112 |