Log in Start free

Vulnerability · Published Oct 5, 2026 · Assigned by GitHub_M

CVE-2026-105630Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover)

High 8.7

In plain English

A high-severity cross-site scripting in plane from makeplane. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)8.7High
Exploit odds (30 days)0.2%top 88.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment. The file retains the attacker-controlled Content-Type, and the asset-download endpoint creates a presigned URL with Content-Disposition: inline. In the default self-hosted MinIO deployment, the asset URL is served from the same origin as the Plane application, allowing embedded SVG JavaScript to execute in the application's security context. A victim, including a workspace administrator, who opens the link can have the session compromised through stored XSS, leading to account takeover. This issue is fixed in 1.4.0.

Affected products (as reported)

VendorProductVersions
makeplane plane < 1.4.0

Weakness: CWE-79, CWE-434, CWE-616 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

References