GHSA-8pcw-h6w9-h46g
plone.app.contenttypes has a Denial of Service in File Upload due to excessive filename length
GHSA-8pcw-h6w9-h46g is a medium vulnerability (CVSS 6.5) in plone-app-contenttypes, published September 23, 2026. No source lists public exploit code. Fixed in plone-app-contenttypes 5.0.1.
- Severity
- 6.5 MediumCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
5.0.1plone-app-contenttypes +5 more
Description
Impact
When creating an Image or File with a very large filename, Plone can become unresponsive. Even if the content loads, it can be hard to edit or delete, because the UI is unwieldy.
Patches
The problem has been patched in plone.app.contenttypes.
- On Plone 6.2, upgrade to
plone.app.contenttypes5.0.1. - On Plone 6.1, upgrade to
plone.app.contenttypes4.0.10. - On Plone 6.0, upgrade to
plone.app.contenttypes3.0.12
Another part of this problem has been patched in plone.app.dexterity. See this advisory.
Workarounds
There are no known workarounds.
This problem was responsibly reported by Aldin Visnjic to the Plone/Zope Security Team. Thank you!
Note: The Plone/Zope Security team felt that the kind of fixes that were needed could be disruptive in corner cases if they were not careful. So they decided to develop the fixes publicly, giving the whole community the chance the review, and giving them the benefit from early feedback.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Affected packages
| Package | Affected | Fixed |
|---|---|---|
plone-app-contenttypesPyPI | 5.0.0 to 5.0.0 | 5.0.1 |
plone-app-contenttypesPyPI | 4.0.0 to 4.0.9 | 4.0.10 |
plone-app-contenttypesPyPI | through 3.0.11 | 3.0.12 |
plone-app-contenttypesPyPI | 5.0.0 up to 5.0.1 | 5.0.1 |
plone-app-contenttypesPyPI | 4.0.0 up to 4.0.10, plus listed versions 4.0.14.0.24.0.34.0.44.0.5 Show 4 moreShow less4.0.64.0.74.0.84.0.9 | 4.0.10 |
plone-app-contenttypesPyPI | before 3.0.12, plus listed versions 1.01.0b11.0b21.0rc11.1 Show 45 moreShow less1.1.11.1.21.1.31.1.41.1.51.1.61.1.71.1.81.1.91.1a11.1b11.1b21.1b31.1b41.1b51.1b61.2.01.2.11.2.101.2.111.2.121.2.131.2.141.2.151.2.161.2.171.2.181.2.191.2.21.2.201.2.211.2.221.2.231.2.241.2.251.2.261.2.271.2.31.2.41.2.51.2.61.2.71.2.81.2.91.2a1 | 3.0.12 |
What each source reports
GitHub Advisories Score used
plone.app.contenttypes has a Denial of Service in File Upload due to excessive filename length
Impact
When creating an Image or File with a very large filename, Plone can become unresponsive. Even if the content loads, it can be hard to edit or delete, because the UI is unwieldy.
Patches
The problem has been patched in plone.app.contenttypes.
- On Plone 6.2, upgrade to
plone.app.contenttypes5.0.1. - On Plone 6.1, upgrade to
plone.app.contenttypes4.0.10. - On Plone 6.0, upgrade to
plone.app.contenttypes3.0.12
Another part of this problem has been patched in plone.app.dexterity. See this advisory.
Workarounds
There are no known workarounds.
This problem was responsibly reported by Aldin Visnjic to the Plone/Zope Security Team. Thank you!
Note: The Plone/Zope Security team felt that the kind of fixes that were needed could be disruptive in corner cases if they were not careful. So they decided to develop the fixes publicly, giving the whole community the chance the review, and giving them the benefit from early feedback.
- Record
GHSA-8pcw-h6w9-h46g- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
plone.app.contenttypes has a Denial of Service in File Upload due to excessive filename length
Impact
When creating an Image or File with a very large filename, Plone can become unresponsive. Even if the content loads, it can be hard to edit or delete, because the UI is unwieldy.
Patches
The problem has been patched in plone.app.contenttypes.
- On Plone 6.2, upgrade to
plone.app.contenttypes5.0.1. - On Plone 6.1, upgrade to
plone.app.contenttypes4.0.10. - On Plone 6.0, upgrade to
plone.app.contenttypes3.0.12
Another part of this problem has been patched in plone.app.dexterity. See this advisory.
Workarounds
There are no known workarounds.
This problem was responsibly reported by Aldin Visnjic to the Plone/Zope Security Team. Thank you!
Note: The Plone/Zope Security team felt that the kind of fixes that were needed could be disruptive in corner cases if they were not careful. So they decided to develop the fixes publicly, giving the whole community the chance the review, and giving them the benefit from early feedback.
- Record
GHSA-8pcw-h6w9-h46g- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/plone/plone.app.contenttypes/security/advisories/GHSA-8pcw-h6w9-h46g
Show 6 moreShow less
Left out here: 81 versions. The JSON record has them.