plone.app.contenttypes has a Denial of Service in File Upload due to excessive filename length
### Impact
When creating an Image or File with a very large filename, Plone can become unresponsive. Even if the content loads, it can be hard to edit or delete, because the UI is unwieldy.
### Patches
The problem has been patched in `plone.app.contenttypes`.
* On Plone 6.2, upgrade to `plone.app.contenttypes ` 5.0.1.
* On Plone 6.1, upgrade to `plone.app.contenttypes ` 4.0.10.
* On Plone 6.0, upgrade to `plone.app.contenttypes ` 3.0.12
Another part of this problem has been patched in `plone.app.dexterity`. See [this advisory](https://github.com/plone/plone.app.dexterity/security/advisories/GHSA-5426-92w4-wvhv).
### Workarounds
There are
Cross-site Scripting and Open Redirect in plone.app.contenttypes
### Impact
Plone is vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish.
The technique is known as cache poisoning.
Any later visitor can get redirected when clicking on a link on this page.
Usually only anonymous users are affected, but this depends on your cache settings.
### Patches
New versions of plone.app.contenttypes have been released.
Version 2.2.3 works on Plone 5.2 and will be included in Plone 5.2.7.
Version 3.0.0a9 works on Plone 6 and will be included in Plone 6.0.0a3.
Note that the Products.CMFPlone p
A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.