plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portlets/rss.py to download and retain excessive data in memory and deny service. The same RSS URL handling accepts internal hosts, IP addresses, single-word domains, and explicit ports, allowing server-side requests that can probe internal network services and open ports. A malicious feed item can also supply a JavaScript URL that is retained as the item link and can execute script when used by a victim. The affected logic includes _rss_feed_url_validator, _normal_url_validator, RSSFeed._retrieveFeed, RSSFeed._buildItemDict, and the FEED_DATA in-memory cache. This issue is fixed in versions 5.0.8, 6.0.4, and 7.0.2.

CVE-2026-55248 affects plone.app.portlets, a portlet management component for the Plone CMS. Versions prior to 5.0.8, 6.0.4, and 7.0.2 are vulnerable to three distinct issues. First, a member with RSS portlet permissions can supply a URL pointing to a very large response, causing excessive memory consumption and denial of service. Second, the RSS URL validator inadequately restricts targets, permitting server-side request forgery (SSRF) to internal hosts, IP addresses, single-word domains, and arbitrary ports, enabling internal network probing. Third, malicious RSS feed items can inject JavaScript URLs as item links, leading to potential cross-site scripting (XSS) when a victim interacts with the link. Affected code includes URL validators, feed retrieval, item dictionary building, and the in-memory FEED_DATA cache. Fixes are available in versions 5.0.8, 6.0.4, and 7.0.2.