CVE-2013-4199: Plone - Denial of Service via Large Zip Archive
Summary
CVE-2013-4199: Plone Denial of Service vulnerability via decompressing large zip archives. Affects plone across 3 version ranges.
>= 2.1, < 4.1.1
>= 4.2, < 4.2.6
>= 4.3, < 4.3.2
Fixed in 4.1.1, 4.2.6 or 4.3.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Plone is an open-source content management system built on top of the Zope application server. It provides a user-friendly interface for managing websites and supports various features such as content creation, collaboration, and workflow management. Plone is widely used in both small and large organizations for building robust and scalable web applications. However, versions 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 of Plone are vulnerable to a denial of service (DoS) attack when processing large zip archives.
Vulnerability Detail
The vulnerability in Plone arises from two components: cb_decode.py and linkintegrity.py. These components fail to handle large zip archives properly, leading to resource consumption and a potential denial of service. An authenticated remote user can exploit this vulnerability by uploading a large zip archive, which is then expanded (decompressed) by the affected components. As a result, the system's resources, such as CPU and memory, can be exhausted, causing a DoS condition. This vulnerability can impact the availability and performance of the Plone application.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.1, < 4.1.14.1.1pip install --upgrade "plone==4.1.1" -
>= 4.2, < 4.2.64.2.6pip install --upgrade "plone==4.2.6" -
>= 4.3, < 4.3.24.3.2pip install --upgrade "plone==4.3.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can implement restrictions on the size of uploaded zip archives. This can be achieved by configuring the Plone application or using server-side settings to limit the maximum allowed size for file uploads. By enforcing a reasonable size limit, the risk of a DoS attack through large zip archives can be mitigated. However, this workaround may impact legitimate users who need to upload larger files, so it should be carefully considered based on the specific requirements of the application.
Conclusion
The vulnerability in Plone versions 2.1 through 4.3.1 allows authenticated remote users to cause a denial of service by uploading large zip archives. To mitigate this risk, it is crucial to upgrade to a fixed version of Plone (4.1.1, 4.2.6, or 4.3.2). Additionally, implementing restrictions on the size of uploaded zip archives can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
Plone is an open-source content management system built on top of the Zope application server. It provides a user-friendly interface for managing websites and supports various features such as content creation, collaboration, and workflow management.
Versions 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 of Plone are affected by this vulnerability.
This vulnerability can be exploited by authenticated remote users to cause a denial of service (DoS) condition on the Plone application. It can lead to resource exhaustion and impact the availability and performance of the system.
To fix this vulnerability, it is recommended to upgrade your Plone installation to one of the fixed versions: 4.1.1, 4.2.6, or 4.3.2. Follow the official Plone documentation or seek assistance from the Plone community for detailed instructions on upgrading.
Yes, you can implement restrictions on the size of uploaded zip archives to mitigate the risk. Configure the Plone application or use server-side settings to limit the maximum allowed size for file uploads. However, be cautious as this may impact legitimate users who need to upload larger files.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
