CVE-2013-4194: Plone WYSIWYG Component Information Disclosure

plone Updated 02 Oct 2025

Summary

11/03/2014

Disclosed on

CVE-2013-4194

CVE

Yes i

Fix available

Moderate

Severity

3.7

CVSS Score

CVE-2013-4194: The WYSIWYG component (wysiwyg.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers to obtain sensitive information via a crafted URL, which reveals the installation path in... Affects plone across 3 version ranges.

>= 2.1, < 4.1.1 >= 4.2, < 4.2.6 >= 4.3, < 4.3.2

Fixed in 4.1.1, 4.2.6 or 4.3.2, depending on the release line you run. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Plone is an open-source content management system (CMS) built on top of the Zope application server. It provides an intuitive interface for managing websites, allowing users to create, edit, and publish content easily. The WYSIWYG component (wysiwyg.py) is responsible for providing a What You See Is What You Get editor for content creation. It is used in Plone versions 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1.

Vulnerability Detail

The WYSIWYG component in Plone is vulnerable to an information disclosure issue. An attacker can exploit this vulnerability by crafting a malicious URL, which triggers an error message revealing the installation path of the Plone instance. This sensitive information can be leveraged by an attacker to gain further knowledge about the system and potentially plan targeted attacks.

How To Fix

Latest published version: 6.2.2 as of 23 Oct 2026

pip install --upgrade "plone==6.2.2"

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

>= 2.1, < 4.1.1 4.1.1
```
pip install --upgrade "plone==4.1.1"
```
>= 4.2, < 4.2.6 4.2.6
```
pip install --upgrade "plone==4.2.6"
```
>= 4.3, < 4.3.2 4.3.2
```
pip install --upgrade "plone==4.3.2"
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

There is no specific workaround provided for this vulnerability. It is advised to apply the recommended fix by upgrading to a patched version of Plone.

Conclusion

The Plone WYSIWYG component is vulnerable to an information disclosure issue that can reveal the installation path of the Plone instance. This sensitive information can be leveraged by attackers to gain insights into the system's structure and potentially plan targeted attacks. To mitigate this vulnerability, it is recommended to upgrade to a fixed version of Plone (4.1.1, 4.2.6, or 4.3.2). For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for plone →

FAQ

What is Plone?

Plone is an open-source content management system (CMS) built on top of the Zope application server. It provides a user-friendly interface for managing websites and creating content.

What is the WYSIWYG component in Plone?

The WYSIWYG component (wysiwyg.py) in Plone is responsible for providing a What You See Is What You Get editor for content creation. It allows users to easily format and style their content.

How does this vulnerability occur?

This vulnerability occurs due to a flaw in the WYSIWYG component of Plone. When a crafted URL is accessed, it triggers an error message that inadvertently reveals the installation path of the Plone instance.

What can an attacker do with the installation path information?

By obtaining the installation path of a Plone instance, an attacker can gain insights into the system's structure and potentially plan targeted attacks. This information can be used to identify other vulnerabilities or weaknesses in the system.

How can I protect my Plone installation from this vulnerability?

To protect your Plone installation, it is crucial to upgrade to a fixed version of Plone. Ensure that you are running one of the patched versions: 4.1.1, 4.2.6, or 4.3.2.

References

Related vulnerabilities

Recent vulnerabilities recorded for plone.

View all plone vulnerabilities →

How To Fix

Latest published version: 6.2.2 as of 23 Oct 2026

pip install --upgrade "plone==6.2.2"

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

>= 2.1, < 4.1.1 4.1.1
```
pip install --upgrade "plone==4.1.1"
```
>= 4.2, < 4.2.6 4.2.6
```
pip install --upgrade "plone==4.2.6"
```
>= 4.3, < 4.3.2 4.3.2
```
pip install --upgrade "plone==4.3.2"
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Subscribe to Vulert on Telegram

Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.

Join the channel →