Plone hotfix, 2026-11-10

It is a chain of several issues, which are fixed separately:

• Products.CMFEditions: missing security declarations on the conditional modifiers in portal_modifier. Anonymous users could change their TALES condition, which is evaluated when content is versioned. See GHSA-67qm-q795-jh7h.

• Products.CMFPlone: allow_module was used on whole modules (Products.CMFPlone.utils, Products.CMFPlone.browser.navtree, OFS.ObjectManager), which made everything those modules import available to restricted code, for example os. allow_class could be called from restricted code. See GHSA-92qw-564p-pmg6.

• Products.MimetypesRegistry: allow_module on the common module also made allow_class available to restricted code. See GHSA-xcj2-cmp9-fj62.

• plone.batching: allow_module made allow_class and allow_module available to restricted code. See GHSA-6hcx-c235-cxh3.

• plone.restapi: allow_module("json") made json.dump and json.load available to restricted code. These call the protected write and read methods of any object without security checks. See GHSA-vgxm-pwch-89q6.

Each fix is only applied when the package is installed. When a package is not installed, the hotfix skips that fix and logs it.

Compatibility

This hotfix should be applied to the following versions of Plone:

• Plone 6.2, 6.1 and 6.0, on Python 3

• Plone 5.2, on Python 2.7 and Python 3

• Plone 5.1, 5.0 and 4.3, on Python 2.7

The fixes will be included in the next releases of the affected packages. When you use fixed versions of all these packages, you do not need this hotfix, but it does no harm either.

Installation

Choose one of these ways, then restart all Zope instances.

• Buildout: add Products.PloneHotfix20261110 to the eggs of your instance and run buildout.

• pip: pip install Products.PloneHotfix20261110.

• Manual, for old Plone versions 5.1 or earlier: copy the Products/PloneHotfix20261110 folder from the source distribution into the products directory of your instance, for example the directory that the products option of plone.recipe.zope2instance points to. No buildout run is needed.

ModuleNotFoundError: No module named 'Products.PageTemplates'

bin/pip install horse-with-no-namespace

What the hotfix changes

Module security

The modules that were opened with allow_module are closed again. Only explicit names stay available to restricted code (Python Scripts, page templates, TALES expressions). Products.CMFPlone calls allow_module in its own initialize function, which Zope calls after the hotfix is imported, and since Plone 6.0 a second time at the end of the product initialization. So the hotfix closes the modules again in its own initialize function and at the end of startup, before Zope serves any request.

For compatibility with the skin scripts and templates of Plone 4.3 to 6.0 these names also stay available: PloneMessageFactory, PloneLocalesMessageFactory and Batch from Products.CMFPlone, getNavigationRoot from Products.CMFPlone.browser.navtree and isLinked from Products.CMFPlone.utils.

If your own Python Scripts import other names from these modules, they now get an Unauthorized error. Declare the names you need in your own add-on with ModuleSecurityInfo(module).declarePublic(name). Never use allow_module for this.

AccessControl

allow_module, allow_class, allow_type, ClassSecurityInfo, ModuleSecurityInfo and setSecurityPolicy can never be called from restricted code. The same is true for the os, sys, subprocess and shutil modules.

CMFEditions modifiers

edit of the conditional modifiers requires the Manage portal permission, the other methods require View management screens, and the internal hooks of the size guard modifiers are private.

Q&A

Q: How can I confirm that the hotfix is installed correctly and my site is protected?

A: On startup, the hotfix logs messages like these to the Zope event log:

INFO [Products.PloneHotfix20261110] Applied accesscontrol patch (GHSA-92qw-564p-pmg6).
INFO [Products.PloneHotfix20261110] Applied cmfplone patch (GHSA-92qw-564p-pmg6).
INFO [Products.PloneHotfix20261110] Closed module Products.MimetypesRegistry (was opened with allow_module).
INFO [Products.PloneHotfix20261110] Applied mimetypesregistry patch (GHSA-xcj2-cmp9-fj62).
INFO [Products.PloneHotfix20261110] plone.restapi is not installed: restapi patch not needed.
...
INFO [Products.PloneHotfix20261110] Hotfix installed.
INFO [Products.PloneHotfix20261110] Closed module Products.CMFPlone.utils (was opened with allow_module).
...
INFO [Products.PloneHotfix20261110] No changed modifier conditions found.

The exact messages depend on the packages you use. If a patch fails, the hotfix logs an error that says “Could not apply”. This may mean that you have a non-standard installation. Please investigate.

Q: What does the warning “POSSIBLE ATTACK: MODIFIED VERSIONING CONDITIONS FOUND” mean?

A: At the end of startup the hotfix checks the TALES conditions of the modifiers in portal_modifier of every Plone site. The hotfix stops new attacks, but a condition that an attacker has already changed stays in the database. If any condition differs from the default, the hotfix logs one warning instead of “No changed modifier conditions found.” You should investigate whether this difference is intentional or not.

Changelog