CVE-2013-4191: zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce acc...

Security readout for executives and security teams

Older Plone sites could expose protected content through generated zip archives. A remote attacker may be able to read sensitive material that normal access controls should block. The supplied sources do not provide a CVSS score or evidence of active exploitation. Exposure is most likely on legacy Plone deployments in the affected version ranges that allow users or visitors to generate or retrieve zip archives containing site content. Treat as a legacy-platform data exposure risk. It is not presented as actively exploited in the supplied sources, but affected internet-facing Plone sites should be remediated because the impact is unauthorized access to sensitive content. Mitigation focus: Apply the Plone 20130618 vendor hotfix where applicable.; Check the Plone advisory for supported upgrade guidance.; Prioritize sites containing private, regulated, or customer data..

Prepared

Jun 14, 2026, 14:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.