Plane: Stored XSS via SVG attachment served inline on application origin
Summary
Plane, an open-source project management tool, serves uploaded SVG attachments inline on the application's origin in its default self-hosted MinIO setup. An authenticated workspace member, including a Guest, can upload a crafted SVG containing JavaScript. When a victim, including a workspace administrator, opens the link, the script runs in the Plane security context and can compromise the session, enabling account takeover. User interaction is required.
Affected
- Plane versions prior to 1.4.0
- Default self-hosted deployments using MinIO
Fixed in
- Fixed in Plane 1.4.0 (upstream PR #9312, commit 9dff20e04808286acb372119d88c666b802b1d50)
Workaround
Unknown.
Exploitation
- CISA SSVC: Exploitation status 'poc', automatable: no
- Not listed in CISA KEV as of the research date
- No public exploit code identified
Our recommendation
- Identify all Plane instances and their versions, including container images
- Upgrade to Plane 1.4.0 at minimum, preferably the latest 1.4.x release
- Review Guest accounts and recent SVG or generic uploads
- If an untrusted link was opened by an administrator, review that session and consider forcing a password reset and session invalidation
- Restrict exposure of Plane instances to the internet where possible
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-ch8j-vr4r-qf6h github.com
- Fix commit 9dff20e github.com
- Pull Request #9312 github.com
- Plane Release v1.4.0 github.com
- OSV CVE-2026-105630 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:33.
Original description (NVD)
Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment. The file retains the attacker-controlled Content-Type, and the asset-download endpoint creates a presigned URL with Content-Disposition: inline. In the default self-hosted MinIO deployment, the asset URL is served from the same origin as the Plane application, allowing embedded SVG JavaScript to execute in the application's security context. A victim, including a workspace administrator, who opens the link can have the session compromised through stored XSS, leading to account takeover. This issue is fixed in 1.4.0.
NVD references (5)
- https://github.com/makeplane/plane/commit/9dff20e04808286acb372119d88c666b802b1d50
- https://github.com/makeplane/plane/pull/9312
- https://github.com/makeplane/plane/releases/tag/v1.4.0
- https://github.com/makeplane/plane/security/advisories/GHSA-ch8j-vr4r-qf6h
- https://github.com/makeplane/plane/security/advisories/GHSA-ch8j-vr4r-qf6h
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.