CVE-2013-4194: The WYSIWYG component (wysiwyg.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 a...

Security readout for executives and security teams

This Plone issue can expose the server installation path through an error message in the WYSIWYG component. That is not direct system compromise, but it leaks useful reconnaissance data to remote attackers and should be fixed on legacy internet-facing Plone sites. Exposure is most likely on older Plone deployments that still run the affected version ranges, especially public sites where unauthenticated users can reach WYSIWYG-related routes or error handling paths. Treat this as a targeted legacy-platform cleanup item. It is not described as actively exploited, but public Plone sites should be patched because path disclosure lowers attacker effort and indicates outdated software. Mitigation focus: Identify Plone deployments running the affected version ranges.; Apply the Plone 20130618 hotfix where vendor guidance says it applies.; Upgrade to a non-affected Plone release where feasible..

Prepared

Jun 14, 2026, 14:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.