---
id: CVE-2020-28736
aliases:
  - GHSA-2c8c-84w2-j38j
  - PYSEC-2020-248
  - PYSEC-2026-735
title: Improper Restriction of XML External Entity Reference in Plone
summary: Improper Restriction of XML External Entity Reference in Plone
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: plone
product: plone
ecosystem: pip
affected:
  - plone < 5.2.3
  - plone-app-event < 3.2.10
  - plone-app-theming < 4.1.6
  - plone-app-dexterity < 2.6.8
  - plone-supermodel < 1.6.3
patched:
  - plone 5.2.3
  - plone-app-event 3.2.10
  - plone-app-theming 4.1.6
  - plone-app-dexterity 2.6.8
  - plone-supermodel 1.6.3
published: '2021-04-07'
updated: '2026-07-06'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-2c8c-84w2-j38j'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2020-28736'
  - url: 'https://github.com/plone/Products.CMFPlone/issues/3209'
  - url: 'https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt'
  - url: 'https://github.com/advisories/GHSA-2c8c-84w2-j38j'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-248.yaml
  - url: 'https://www.misakikata.com/codes/plone/python-en.html'
tags:
  - osv
  - pip
epss: 0.01453
epssPercentile: 0.72282
ingestedAt: '2026-07-08T18:25:44.202Z'
---

## Overview

Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role).

## Affected packages

- `plone < 5.2.3`
- `plone-app-event < 3.2.10`
- `plone-app-theming < 4.1.6`
- `plone-app-dexterity < 2.6.8`
- `plone-supermodel < 1.6.3`

## Remediation

Upgrade to a patched release:

- `plone 5.2.3`
- `plone-app-event 3.2.10`
- `plone-app-theming 4.1.6`
- `plone-app-dexterity 2.6.8`
- `plone-supermodel 1.6.3`