CVE-2026-55247: CWE-400: Uncontrolled Resource Consumption in plone plone.app.event

The vulnerability in plone.app.event's iCalendar import functionality allows insufficiently restricted calendar and event URLs, unbounded downloaded bytes and imported events, and commits work per event. This enables a logged-in editor to cause the server to request internal network or local resources, exhaust server resources, and potentially take the site offline. Additionally, malicious event URLs can execute scripts in other users' browsers. The fix in versions 5.2.4 and 6.0.1 restricts accepted URLs, enforces maximum import size and event limits, uses transaction savepoints, and validates event URLs to prevent exploitation.

An authenticated editor can cause denial of service by exhausting server resources through unbounded iCalendar imports. There is also a cross-user scripting risk via malicious event URLs. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS score of 9.1 indicating critical severity.

The vulnerability is fixed in plone.app.event versions 5.2.4 and 6.0.1. Users should upgrade to these or later versions to remediate the issue. No other mitigation is indicated or required per the vendor advisory.