CVE-2016-4043: Plone - Chameleon Template Bypass
Summary
CVE-2016-4043: Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates. Affects plone versions >= 5.0rc1, < 5.1a2. Fixed in 5.1a2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system built on top of the Zope application server. It provides an intuitive interface for managing websites and supports various features such as content creation, collaboration, and workflow management. Chameleon is a templating engine used in Plone for rendering dynamic web pages. It allows users to create and edit templates to customize the appearance and functionality of their websites.
Vulnerability Detail
The Chameleon (five.pt) component in Plone versions 5.0rc1 through 5.1a1 is susceptible to a vulnerability that enables remote authenticated users to bypass Restricted Python. This vulnerability can be exploited by leveraging permissions to create or edit templates. By doing so, an attacker can execute arbitrary code or perform unauthorized actions within the Plone environment.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.1a2
This is the first release that contains the fix.
pip install --upgrade "plone==5.1a2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to restrict template creation and editing permissions to trusted users only. By limiting access to the Chameleon templates, the likelihood of exploitation can be reduced. However, this is not a permanent solution, and upgrading to the fixed version is still strongly advised.
Conclusion
The Chameleon Template Bypass vulnerability in Plone versions 5.0rc1 through 5.1a1 allows authenticated users to bypass Restricted Python and potentially execute arbitrary code or perform unauthorized actions. To mitigate this risk, it is recommended to upgrade to Plone version 5.1a2 or later. Restricting template creation and editing permissions can serve as a temporary workaround. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
This vulnerability allows authenticated users to bypass Restricted Python and execute arbitrary code or perform unauthorized actions within the Plone environment. It can lead to unauthorized access, data manipulation, or even complete compromise of the affected Plone instance.
Only authenticated users with sufficient permissions to create or edit templates in Plone are able to exploit this vulnerability. Regular website visitors or unauthenticated users cannot directly exploit this issue.
There are no known instances of this vulnerability being exploited in the wild. However, it is crucial to apply the recommended fix or workaround to mitigate the risk of potential exploitation.
No, this vulnerability requires authentication as a prerequisite for exploitation. Remote exploitation is not possible without valid credentials and sufficient permissions within the Plone environment.
For more detailed information about this vulnerability, including its technical aspects and the specific changes made in the fixed version, you can refer to the official advisory provided by the Plone community. The advisory can be found at: https://github.com/pypa/advisory-database/blob/main/vulns/plone/PYSEC-2017-57.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for plone.
