---
id: CVE-2020-28735
aliases:
  - GHSA-x7wf-5mjc-6x76
  - PYSEC-2020-247
  - PYSEC-2026-737
title: SSRF attacks via tracebacks in Plone
summary: SSRF attacks via tracebacks in Plone
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: plone
product: plone
ecosystem: pip
affected:
  - plone < 5.2.3
  - plone-app-event < 3.2.10
  - plone-app-theming < 4.1.6
  - plone-app-dexterity < 2.6.8
  - plone-supermodel < 1.6.3
patched:
  - plone 5.2.3
  - plone-app-event 3.2.10
  - plone-app-theming 4.1.6
  - plone-app-dexterity 2.6.8
  - plone-supermodel 1.6.3
published: '2021-04-07'
updated: '2026-07-06'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-x7wf-5mjc-6x76'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2020-28735'
  - url: 'https://github.com/plone/Products.CMFPlone/issues/3209'
  - url: 'https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt'
  - url: 'https://github.com/advisories/GHSA-x7wf-5mjc-6x76'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-247.yaml
  - url: 'https://www.misakikata.com/codes/plone/python-en.html'
tags:
  - osv
  - pip
epss: 0.01435
epssPercentile: 0.71974
ingestedAt: '2026-07-08T18:25:54.142Z'
---

## Overview

Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).

## Affected packages

- `plone < 5.2.3`
- `plone-app-event < 3.2.10`
- `plone-app-theming < 4.1.6`
- `plone-app-dexterity < 2.6.8`
- `plone-supermodel < 1.6.3`

## Remediation

Upgrade to a patched release:

- `plone 5.2.3`
- `plone-app-event 3.2.10`
- `plone-app-theming 4.1.6`
- `plone-app-dexterity 2.6.8`
- `plone-supermodel 1.6.3`