plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection

Date Sep 23, 2026

Type Vendor advisory

Signal High-risk advisory

Vendor / Product PyPI · plone.app.portlets

CVE CVE-2026-57149

High-risk advisory CVE-2026-57149

Summary

plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection

Why it matters

GitHub has published a reviewed security advisory for plone.app.portlets. Prioritize it with other application dependency updates.

Operator check

Check whether plone.app.portlets is present in application dependency manifests, lockfiles, or build images. Review the GitHub advisory and upgrade to a patched version where available.

Sources

GitHub Advisory GHSA-rr49-f9g6-c9r5 NVD — CVE-2026-57149 Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed