p PatchFirst

CVE-2026-28413

CVE-2026-28413 · Products.isurlinportal: Possible open redirect when using more than 2 forward slashes

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Products.isurlinportal is a replacement for isURLInPortal method in Plone. Prior to versions 2.1.0, 3.1.0, and 4.0.0, a url /login?came_from=////evil.example may redirect to an external website after login. This issue has been patched in versions 2.1.0, 3.1.0, and 4.0.0.

CVSS 5.3 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • products.isurlinportal

    Versions
    • < 4.0.0: Affected
    • < 3.1.0: Affected
    • < 2.1.0: Affected

    No fix published

  • products-isurlinportal PyPI

    Versions
    • 4.0.0a1
    Affected ranges
    • ECOSYSTEM: ≥ 4.0.0a1, < 4.0.0

    Update to 4.0.0

  • products-isurlinportal PyPI

    Versions
    • 3.0.0
    • 3.0.1
    Affected ranges
    • ECOSYSTEM: ≥ 3.0.0, < 3.1.0

    Update to 3.1.0

  • products-isurlinportal PyPI

    Versions
    • 1.0.0
    • 1.1.0
    • 1.1.1
    • 1.2.0
    • 1.2.1
    • 2.0.0
    • 2.0.1
    • 2.0.2
    • 2.0.3
    Affected ranges
    • ECOSYSTEM: < 2.1.0

    Update to 2.1.0

  • products-isurlinportal PyPI

    Versions
    • 1.0.0
    • 1.1.0
    • 1.1.1
    • 1.2.0
    • 1.2.1
    • 2.0.0
    • 2.0.1
    • 2.0.2
    • 2.0.3
    • 3.0.0
    • 3.0.1
    Affected ranges
    • ECOSYSTEM: < 2.1.0 ∪ ≥ 3.0.0, < 3.1.0

    Update to 2.1.0; Update to 3.1.0

Original sources

Check your server →