Read the docs
TI-2023-14603 Aliases CVE-2023-30791GHSA-fjvj-rr24-chm8

Plane 0.7.1 - Insecure file upload

Priority HIGH 66CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

Plane version 0.7.1-dev allows an attacker to change the avatar of his profile, which allows uploading files with HTML extension that interprets both HTML and JavaScript.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0053 45th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
makeplanePlane0.7.1—No fix listedCNA
  • Plane Vendormakeplane Affected 0.7.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:plane:plane:0.7.1:*:*:*:*:*:*:*0.7.1Vulnerablemakeplane
  • cpe:2.3:a:plane:plane:0.7.1:*:*:*:*:*:*:* Versions 0.7.1 Vulnerable ·makeplane

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-30791
  2. 2026-10-03 Alias added: GHSA-fjvj-rr24-chm8

References

Exploit 1

Other 1

  • TI-2024-32097 Plane allows server side request forgery via /_next/image endpoint CVSS 3.1CRITICAL 9.3
  • TI-2026-34237 Authorization bypass in makeplane plane CVSS 3.1HIGH 8.3
  • TI-2023-02127 Plane v0.7.1 - Unauthorized access to files CVSS 3.1HIGH 7.5
  • TI-2026-28725 Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching CVSS 3.1HIGH 7.7
  • TI-2026-28361 Plane IDOR: Cross-Project Issue Date Modification via Bulk Update Endpoint CVSS 3.1HIGH 7.7
  • TI-2026-09315 Plane 1.3.1 - Stored XSS in intake issue description_html CVSS 4.0MEDIUM 6.9
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences