A critical remote code execution vulnerability in the Plone Classic portlet allows authenticated users to achieve full system compromise.

This is an eval injection vulnerability (CWE-95) where the Classic portlet improperly processes template or macro fields as TALES expressions. Any authenticated user with permission to configure a Classic portlet can supply a malicious payload that is executed by the server-side process, resulting in privilege escalation.

The ability for a standard authenticated user to execute arbitrary code on the server represents a total loss of confidentiality, integrity, and availability. Given the CVSS score of 9.9, this vulnerability poses an extreme risk to the entire Plone infrastructure, potentially leading to complete data exfiltration, unauthorized modification of site content, and total system takeover.

Immediate Action: Upgrade plone.app.portlets to version 5.0.8, 6.0.4, or 7.0.2 respectively, depending on the current branch in use.

Proactive Monitoring: Monitor server logs for unusual portlet configuration activity or unexpected process execution spawned by the Plone service user.

Compensating Controls: If patching is not immediately feasible, restrict the ManageOwnPortlets permission from untrusted roles and consider unregistering the Classic portlet via portlets.xml configuration.

Public Exploit Available: Unknown

Due to the critical nature of this vulnerability and the potential for full system compromise, administrators must prioritize the application of the provided security patches. Verify your current version of plone.app.portlets immediately and apply the relevant update to close the injection vector, as manual workarounds are intended only as temporary stopgaps.