Read the docs
TI-2026-67855 Aliases CVE-2026-105630

Stored cross-site scripting in Plane via SVG attachments

Priority HIGH 73CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Code execution, Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434 and CWE-79.

Summary

Plane before 1.4.0 lets an authenticated low-privilege member, including a Guest, upload SVG attachments that are served inline from the application origin in the default MinIO deployment. Scripts in such a file run in the victim's Plane session when a user, including a workspace administrator, opens the link, leading to account takeover (CWE-79).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment. The file retains the attacker-controlled Content-Type, and the asset-download endpoint creates a presigned URL with Content-Disposition: inline. In the default self-hosted MinIO deployment, the asset URL is served from the same origin as the Plane application, allowing embedded SVG JavaScript to execute in the application's security context. A victim, including a workspace administrator, who opens the link can have the session compromised through stored XSS, leading to account takeover. This issue is fixed in 1.4.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00214 11th percentileScored 2026-11-07
Fix Fixed plane (makeplane): 1.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
makeplaneplanebefore 1.4.01.4.0Patch availableCNA
  • plane Vendormakeplane Affected before 1.4.0 Fixed in 1.4.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:plane:plane:*:*:*:*:*:*:*:*——makeplane
  • cpe:2.3:a:plane:plane:*:*:*:*:*:*:*:* Versions — — ·makeplane

Remediation

Upgrade makeplane Plane to version 1.4.0, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA plane (makeplane) Fixed in 1.4.0

Timeline

  1. 2026-10-05 Threatist record created from CVE-2026-105630

References

Other 4

  • TI-2026-67866 Hardcoded secret keys in Plane community deployments CVSS 3.1CRITICAL 9.8
  • TI-2026-67865 Account takeover in Plane via unverified OAuth email matching CVSS 3.1CRITICAL 9.1
  • TI-2026-67863 Plane magic-code login lacks rate limiting, allowing OTP brute force CVSS 3.1CRITICAL 9.1
  • TI-2024-32097 Plane allows server side request forgery via /_next/image endpoint CVSS 3.1CRITICAL 9.3
  • TI-2026-67862 Cross-project asset hijacking in Plane allows file takeover CVSS 3.1CRITICAL 9.6
  • TI-2026-67861 Server-side request forgery in Plane webhook delivery via redirects CVSS 3.1CRITICAL 9.9
See all 65 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences