Read the docs

makeplane

Records66All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical8CVSS 9.0–10.0
CVSS high31CVSS 7.0–8.9

Exploited now

makeplane records in CISA KEV

No makeplane vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Plane 16 records HIGH

Records

16 records in Plane · all components

TI-2023-02127 CVE-2023-2268 · GHSA-h663-pvcv-f942

Plane v0.7.1 - Unauthorized access to files

Priority HIGH 68

Plane version 0.7.1 allows an unauthenticated attacker to view all stored server files of all users.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00662 Published 2023-07-15 No fix listed CWE-862
TI-2023-14603 CVE-2023-30791 · GHSA-fjvj-rr24-chm8

Plane 0.7.1 - Insecure file upload

Priority HIGH 66

Plane version 0.7.1-dev allows an attacker to change the avatar of his profile, which allows uploading files with HTML extension that interprets both HTML and JavaScript.

CVSS 3.1HIGH 7.1 Network Low privileges User interaction EPSS 0.0053 Published 2023-07-15 No fix listed CWE-434
TI-2026-09315 CVE-2026-10850 · GHSA-4fp8-7gvj-j2xg

Plane 1.3.1 - Stored XSS in intake issue description_html

Priority MEDIUM 64

Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the description_html field when creating an intake work item through the API v1 intake endpoint.

CVSS 4.0MEDIUM 6.9 Network Low privileges User interaction EPSS 0.00165 Published 2026-06-17 No fix listed CWE-79
Open these records in search →