CVE-2026-105630

Plane is an open-source project management tool

Risk score: 54/100
CVSS: 8.7 v3.1
Exploit chance (30 days): 0.2%
Published: 5 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment. The file retains the attacker-controlled Content-Type, and the asset-download endpoint creates a presigned URL with Con…
Affected: See advisory
Fix: Upgrade the product to 1.4.0 or later.
Exploitation: No known exploitation

Why it is Yellow

CVSS 8.7 high

References

Original description

Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment. The file retains the attacker-controlled Content-Type, and the asset-download endpoint creates a presigned URL with Content-Disposition: inline. In the default self-hosted MinIO deployment, the asset URL is served from the same origin as the Plane application, allowing embedded SVG JavaScript to execute in the application's security context. A victim, including a workspace administrator, who opens the link can have the session compromised through stored XSS, leading to account takeover. This issue is fixed in 1.4.0.

Last activity 5 Oct 2026. Patch Forecast updates every hour.