Threats affecting pkg:pypi/plone-app-portlets

CVE-2026-57149 is a critical vulnerability in plone.app.portlets affecting versions 5.0.0 up to but not including 5.0.8, 6.0.0 up to but not including 6.0.4, and 7.0.0 up to but not including 7.0.2. The Classic portlet improperly evaluates user-supplied template/macro fields as full TALES expressions, allowing authenticated users with permission to configure Classic portlets to execute arbitrary code in the Plone server process. This leads to privilege escalation from an authenticated user to server-side code execution. The issue has been patched in versions 5.0.8, 6.0.4, and 7.0.2. Workarounds include restricting portlet management permissions and disabling the Classic portlet.