CVE-2016-7135

Plone vulnerable to filesystem information leak

4.9 MediumFix available

CVE-2016-7135 is a medium vulnerability (CVSS 4.9) in Plone, published March 7, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.60%, the 85th percentile. Fixed in plone 5.0.7.

Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary files via a .. (dot dot) in the path parameter in a getFile action to Plone/++theme++barceloneta/@@plone.resourceeditor.filemanager-actions.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

2.60%Up 1.6 points since Feb 4, 2022

What each source reports

NVD Score used 4.9

Record: CVE-2016-7135
CVSS 3.0: 4.9 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-7135
Updated: 2026-11-02

EUVDEUVD-2017-0091 No score

Record: EUVD-2017-0091
Updated: 2026-11-03

GitHub AdvisoriesGHSA-m7f9-65wr-pwch 6.9

Plone vulnerable to filesystem information leak

Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary files via a .. (dot dot) in the path parameter in a getFile action to Plone/++theme++barceloneta/@@plone.resourceeditor.filemanager-actions.

Record: GHSA-m7f9-65wr-pwch
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.0: 4.9 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

OSV 4.9

Record: CVE-2016-7135
CVSS 3.0: 4.9 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVGHSA-m7f9-65wr-pwch 6.9

Plone vulnerable to filesystem information leak

Record: GHSA-m7f9-65wr-pwch
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.0: 4.9 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

OSVPYSEC-2017-58 No score

Record: PYSEC-2017-58
Updated: 2026-11-02

Affected products

plone

Affected packages

Affected packages
Package	Affected	Fixed
`plone` PyPI	5.0 up to 5.0.7	5.0.7
`plone` PyPI	4.2 up to 4.3.12	4.3.12
`plone` PyPI	5.0 up to 5.0.7, plus listed versions 5.0.15.0.25.0.35.0.45.0.55.0.6	5.0.7
`plone` PyPI	4.2 up to 4.3.12, plus listed versions 4.2.14.2.24.2.34.2.44.2.5 Show 19 moreShow less 4.2.64.2.74.34.3.14.3.104.3.114.3.24.3.34.3.44.3.54.3.64.3.74.3.84.3.94.3a14.3a24.3b14.3b24.3rc1	4.3.12
`plone` PyPI	5.0 up to 5.0.7, 4.2 up to 4.3.12, plus listed versions 4.2.14.2.24.2.34.2.44.2.5 Show 25 moreShow less 4.2.64.2.74.34.3.14.3.104.3.114.3.24.3.34.3.44.3.54.3.64.3.74.3.84.3.94.3a14.3a24.3b14.3b24.3rc15.0.15.0.25.0.35.0.45.0.55.0.6	5.0.74.3.12

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 8 moreShow less