plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported events, and commits work per event. A logged-in editor can make the server request internal network resources or local calendar files, exhaust resources and take the site offline, and store a malicious event URL that executes script in another user's browser. The fix restricts accepted URLs, applies MAXIMUM_ICAL_IMPORT_SIZE_BYTES and MAXIMUM_ICAL_IMPORT_EVENTS limits, uses transaction savepoints, and validates event URLs. This issue is fixed in versions 5.2.4 and 6.0.1.

CVE-2026-55247 affects plone.app.event, the event content type component for the Plone CMS. Versions prior to 5.2.4 and 6.0.1 contain multiple vulnerabilities in the iCalendar import functionality. A logged-in editor can exploit unrestricted URL handling to trigger Server-Side Request Forgery (SSRF), accessing internal network resources or local calendar files. The lack of download size and event count limits enables resource exhaustion and denial of service. Additionally, malicious event URLs can be stored and executed as scripts in other users' browsers, constituting a stored Cross-Site Scripting (XSS) vulnerability. The fix introduces URL restrictions, import size and event count limits (MAXIMUM_ICAL_IMPORT_SIZE_BYTES, MAXIMUM_ICAL_IMPORT_EVENTS), transaction savepoints, and event URL validation. Patches are available in versions 5.2.4 and 6.0.1.