CVE-2026-55247 is a critical-severity (CVSS 9.1) Uncontrolled Resource Consumption vulnerability in plone-app-event. O3 Security confirms whether CVE-2026-55247 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
plone.app.event vulnerable to denial of service via iCalendar import
Real-World Exposure
plone-app-event🐍plone-app-eventReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Impact
By abusing the iCalendar import functionality, a logged-in editor could take the whole site offline, make the server reach into the internal network and read calendar files off disk (SSRF), and store XSS.
Patches
The problem has been patched in plone.app.event.
- For Plone 6.2: upgrade to
plone.app.event6.0.1 - For Plone 6.1: upgrade to
plone.app.event5.2.4 - For Plone 6.0: upgrade to
plone.app.event5.2.4
Workarounds
In the site root, go to the Security tab of the Zope Management Interface (manage_access), look for the "plone.app.event: Import Ical" permission, and grant this only to the Manager role. Then only users with the Manager role can use the ical import form.
There is no workaround for the stored XSS in the URL field of events.
The vulnerabilities were discovered by Timothy Dudley and responsibly reported to the Plone Security Team. Thank you!
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | plone-app-event | all versions | 5.2.4 |
| 🐍PyPI | plone-app-event | ≥ 6.0.0a1&&< 6.0.1 | 6.0.1 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for plone-app-event. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update plone-app-event to 5.2.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-55247 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether CVE-2026-55247 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to CVE-2026-55247. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-55247 in your dependencies?
O3 detects CVE-2026-55247 across PyPI dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.