{"id":"CVE-2020-28736","aliases":["GHSA-2c8c-84w2-j38j","PYSEC-2020-248","PYSEC-2026-735"],"title":"Improper Restriction of XML External Entity Reference in Plone","summary":"Improper Restriction of XML External Entity Reference in Plone","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"plone","product":"plone","ecosystem":"pip","affected":["plone < 5.2.3","plone-app-event < 3.2.10","plone-app-theming < 4.1.6","plone-app-dexterity < 2.6.8","plone-supermodel < 1.6.3"],"patched":["plone 5.2.3","plone-app-event 3.2.10","plone-app-theming 4.1.6","plone-app-dexterity 2.6.8","plone-supermodel 1.6.3"],"published":"2021-04-07","updated":"2026-07-06","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-2c8c-84w2-j38j","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28736"},{"url":"https://github.com/plone/Products.CMFPlone/issues/3209"},{"url":"https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt"},{"url":"https://github.com/advisories/GHSA-2c8c-84w2-j38j"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-248.yaml"},{"url":"https://www.misakikata.com/codes/plone/python-en.html"}],"tags":["osv","pip"],"epss":0.01435,"epssPercentile":0.71945,"ingestedAt":"2026-07-08T18:25:44.202Z","slug":"CVE-2020-28736","body":"## Overview\n\nPlone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role).\n\n## Affected packages\n\n- `plone < 5.2.3`\n- `plone-app-event < 3.2.10`\n- `plone-app-theming < 4.1.6`\n- `plone-app-dexterity < 2.6.8`\n- `plone-supermodel < 1.6.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `plone 5.2.3`\n- `plone-app-event 3.2.10`\n- `plone-app-theming 4.1.6`\n- `plone-app-dexterity 2.6.8`\n- `plone-supermodel 1.6.3`","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}