CVE-2013-4191: Plone - Improper Access Restrictions in zip.py
Summary
CVE-2013-4191: zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including content in a zip archive, which allows remote attackers to obtain sensitive infor... Affects plone across 3 version ranges.
>= 2.1, < 4.1.1
>= 4.2, < 4.2.6
>= 4.3, < 4.3.2
Fixed in 4.1.1, 4.2.6 or 4.3.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system built on top of the Zope application server. It provides a user-friendly interface for managing websites and supports various features such as content creation, collaboration, and workflow management. Plone is widely used in both small and large organizations for building robust and scalable web applications.
Vulnerability Detail
The vulnerability (CVE-2013-4191) exists in the zip.py module of Plone versions 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1. It arises from the improper enforcement of access restrictions when including content in a zip archive. This flaw allows remote attackers to gain unauthorized access to sensitive information by reading a generated archive. By exploiting this vulnerability, an attacker can potentially extract confidential data or obtain insights into the internal structure of the Plone application.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.1, < 4.1.14.1.1pip install --upgrade "plone==4.1.1" -
>= 4.2, < 4.2.64.2.6pip install --upgrade "plone==4.2.6" -
>= 4.3, < 4.3.24.3.2pip install --upgrade "plone==4.3.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched versions of Plone.
Conclusion
The vulnerability in Plone's zip.py module allows remote attackers to gain unauthorized access to sensitive information. It is crucial for Plone users to upgrade their installations to the fixed versions (4.1.1, 4.2.6, or 4.3.2) to mitigate the risk of data exposure. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
Plone is an open-source content management system used for building websites and web applications.
Plone versions 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 are affected.
The vulnerability allows remote attackers to obtain sensitive information by reading generated zip archives, potentially leading to unauthorized access and data exposure.
To fix this vulnerability, upgrade your Plone installation to one of the fixed versions: 4.1.1, 4.2.6, or 4.3.2.
No specific workaround is provided. It is recommended to apply the fix by upgrading to the patched versions.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
