Plone

Plone Portlets Updates Fix Critical TALES Injection

Plone Classic portlet configuration can permit authenticated server-side code execution, including through ordinary users' dashboards. Apply the branch-specific package fix and review stored assignments; restricting new portlet creation alone does not neutralize existing malicious content.