CVE-2007-5741: Plone Arbitrary Code Execution via Unsafe Handling of Pickles
Summary
CVE-2007-5741: Plone Arbitrary Code Execution via Unsafe Handling of Pickles. Affects plone across 2 version ranges.
>= 2.5, < 2.5.5
>= 3.0, < 3.0.3
Fixed in 2.5.5 or 3.0.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system built on top of the Zope application server. It provides a user-friendly interface for managing websites and supports various features such as content creation, collaboration, and workflow management. Plone is widely used in both small and large organizations for building robust and secure web applications.
Vulnerability Detail
Plone versions 2.5 through 2.5.4 and 3.0 through 3.0.2 are vulnerable to arbitrary code execution. This vulnerability allows remote attackers to execute arbitrary Python code by sending network data containing pickled objects for the 'statusmessages' or 'linkintegrity' module. When these modules unpickle and execute the received data, it can lead to the execution of malicious code. This can result in unauthorized access, data breaches, and potential compromise of the entire Plone instance.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.5, < 2.5.52.5.5pip install --upgrade "plone==2.5.5" -
>= 3.0, < 3.0.33.0.3pip install --upgrade "plone==3.0.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is advised to disable the affected modules ('statusmessages' and 'linkintegrity') if they are not essential for the functioning of the Plone instance. This can be done by modifying the Plone configuration or disabling the respective add-ons. However, this workaround may impact the functionality of certain features that rely on these modules.
Conclusion
The vulnerability in Plone, allowing arbitrary code execution via unsafe handling of pickles, poses a significant risk to the security and integrity of Plone instances. It is crucial to upgrade to the fixed versions (2.5.5 or later for 2.5.x and 3.0.3 or later for 3.0.x) to mitigate this vulnerability. Additionally, disabling the affected modules as a temporary workaround can provide some level of protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
The vulnerability allows remote attackers to execute arbitrary Python code, potentially leading to unauthorized access, data breaches, and compromise of the Plone instance.
You can use Vulert's vulnerability playground (https://vulert.com/scanner) to check if your Plone instance is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of this advisory, there are no known public exploits targeting this specific vulnerability. However, it is crucial to apply the recommended fixes promptly to mitigate the risk.
While upgrading to a fixed version is the recommended approach, you can temporarily mitigate the risk by disabling the affected modules ('statusmessages' and 'linkintegrity') if they are not necessary for your Plone instance. However, this is not a permanent solution, and upgrading is strongly advised.
You can find more information about this vulnerability, including the technical details and affected versions, in the official GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-hf26-vvmx-x8c8/GHSA-hf26-vvmx-x8c8.json
Related vulnerabilities
Recent vulnerabilities recorded for plone.
