CVE-2021-33511: Plone

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel.

Affected products

• Plone Plone: up to and including 5.2.4

Published 2021-05-21. Last modified 2026-06-17.