Plane
by Plane
Source repositories
CVEs (23)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-19606 | Cri | 0.64 | 9.8 | 0.02 | Mar 30, 2020 | X-Plane before 11.41 has multiple improper path validations that could allow reading and writing files from/to arbitrary paths (or a leak of OS credentials to a remote system) via crafted network packets. This could be used to execute arbitrary commands on the system. | ||
| CVE-2019-19605 | Cri | 0.64 | 9.8 | 0.02 | Mar 30, 2020 | X-Plane before 11.41 allows Arbitrary Memory Write via crafted network packets, which could cause a denial of service or arbitrary code execution. | ||
| CVE-2025-50251 | Cri | 0.59 | 9.1 | 0.00 | Aug 13, 2025 | Server side request forgery (SSRF) vulnerability in makeplane plane 0.23.1 via the password recovery. | ||
| CVE-2025-62716 | Hig | 0.53 | 8.1 | 0.00 | Oct 24, 2025 | Plane is open-source project management software. Prior to version 1.1.0, an open redirect vulnerability in the ?next_path query parameter allows attackers to supply arbitrary schemes (e.g., javascript:) that are passed directly to router.push. This results in a cross-site… | ||
| CVE-2024-31461 | Cri | 0.52 | 9.1 | 0.01 | Apr 10, 2024 | Plane, an open-source project management tool, has a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 0.17-dev. This issue may allow an attacker to send arbitrary requests from the server hosting the application, potentially leading to unauthorized access to… | ||
| CVE-2026-27706 | Hig | 0.50 | 7.7 | 0.00 | Feb 25, 2026 | Plane is an an open-source project management tool. Prior to version 1.2.2, a Full Read Server-Side Request Forgery (SSRF) vulnerability has been identified in the "Add Link" feature. This flaw allows an authenticated attacker with general user privileges to send arbitrary GET… | ||
| CVE-2026-30242 | Hig | 0.48 | 8.5 | 0.00 | Mar 6, 2026 | Plane is an an open-source project management tool. Prior to version 1.2.3, the webhook URL validation in plane/app/serializers/webhook.py only checks ip.is_loopback, allowing attackers with workspace ADMIN role to create webhooks pointing to private/internal network addresses… | ||
| CVE-2026-46558 | Hig | 0.47 | 8.3 | 0.00 | Jun 10, 2026 | Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces. This issue has been patched in version 1.3.1. | ||
| CVE-2023-30791 | Hig | 0.46 | 7.1 | 0.01 | Jul 15, 2023 | Plane version 0.7.1-dev allows an attacker to change the avatar of his profile, which allows uploading files with HTML extension that interprets both HTML and JavaScript. | ||
| CVE-2023-2268 | Hig | 0.46 | 7.1 | 0.01 | Jul 15, 2023 | Plane version 0.7.1 allows an unauthenticated attacker to view all stored server files of all users. | ||
| CVE-2026-39843 | Hig | 0.43 | 7.7 | 0.00 | Apr 9, 2026 | Plane is an an open-source project management tool. From 0.28.0 to before 1.3.0, the remediation of GHSA-jcc6-f9v6-f7jw is incomplete which could lead to the same full read Server-Side Request Forgery when a normal html page contains a link tag with an href that redirects to a… | ||
| CVE-2026-30244 | Hig | 0.42 | 7.5 | 0.00 | Mar 6, 2026 | Plane is an an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate workspace members and extract sensitive information including email addresses, user roles, and internal identifiers. The vulnerability stems from Django REST… | ||
| CVE-2026-10850 | Med | 0.35 | 5.4 | 0.00 | Jun 17, 2026 | Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the description_html field when creating an intake work item through the API v1 intake endpoint. | ||
| CVE-2026-40102 | Med | 0.35 | 6.5 | 0.00 | May 20, 2026 | Plane is an open-source project management tool. In versions 1.3.0 and below, SavedAnalyticEndpoint passes the user-controlled segment query parameter directly to a Django F() expression without validation (unlike the regular AnalyticsEndpoint, which checks against an… | ||
| CVE-2026-39374 | Med | 0.35 | 6.5 | 0.00 | Apr 7, 2026 | Plane is an an open-source project management tool. Prior to 1.3.0, the IssueBulkUpdateDateEndpoint allows a project member (ADMIN or MEMBER) to modify the start_date and target_date of ANY issue across the entire Plane instance, regardless of workspace or project membership.… | ||
| CVE-2025-21616 | Med | 0.35 | 5.4 | 0.00 | Jan 6, 2025 | Plane is an open-source project management tool. A cross-site scripting (XSS) vulnerability has been identified in Plane versions prior to 0.23. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets… | ||
| CVE-2025-69284 | Med | 0.28 | 4.3 | 0.00 | Jan 2, 2026 | Plane is an an open-source project management tool. In plane.io, a guest user doesn't have a permission to access https[:]//app[.]plane[.]so/[:]slug/settings. Prior to Plane version 1.2.0, a problem occurs when the `/api/workspaces/:slug/members/` is accessible by guest and able… | ||
| CVE-2025-55203 | Med | 0.28 | 5.4 | 0.00 | Aug 15, 2025 | Plane is open-source project management software. Prior to version 0.28.0, a stored cross-site scripting (XSS) vulnerability exists in the description_html field of Plane. This flaw allows an attacker to inject malicious JavaScript code that is stored and later executed in other… | ||
| CVE-2026-27949 | Low | 0.06 | 2.0 | 0.00 | Apr 7, 2026 | Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address is included as a query parameter in the URL during error handling (e.g., when an invalid magic code is submitted).… | ||
| CVE-2026-15342 | Med | 0.00 | 6.5 | 0.00 | Jul 21, 2026 | Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one workspace to access, delete, or duplicate assets belonging to another workspace by providing only the victim workspace slug and asset ID. The affected… |
- risk 0.64cvss 9.8epss 0.02
X-Plane before 11.41 has multiple improper path validations that could allow reading and writing files from/to arbitrary paths (or a leak of OS credentials to a remote system) via crafted network packets. This could be used to execute arbitrary commands on the system.
- risk 0.64cvss 9.8epss 0.02
X-Plane before 11.41 allows Arbitrary Memory Write via crafted network packets, which could cause a denial of service or arbitrary code execution.
- risk 0.59cvss 9.1epss 0.00
Server side request forgery (SSRF) vulnerability in makeplane plane 0.23.1 via the password recovery.
- risk 0.53cvss 8.1epss 0.00
Plane is open-source project management software. Prior to version 1.1.0, an open redirect vulnerability in the ?next_path query parameter allows attackers to supply arbitrary schemes (e.g., javascript:) that are passed directly to router.push. This results in a cross-site…
- risk 0.52cvss 9.1epss 0.01
Plane, an open-source project management tool, has a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 0.17-dev. This issue may allow an attacker to send arbitrary requests from the server hosting the application, potentially leading to unauthorized access to…
- risk 0.50cvss 7.7epss 0.00
Plane is an an open-source project management tool. Prior to version 1.2.2, a Full Read Server-Side Request Forgery (SSRF) vulnerability has been identified in the "Add Link" feature. This flaw allows an authenticated attacker with general user privileges to send arbitrary GET…
- risk 0.48cvss 8.5epss 0.00
Plane is an an open-source project management tool. Prior to version 1.2.3, the webhook URL validation in plane/app/serializers/webhook.py only checks ip.is_loopback, allowing attackers with workspace ADMIN role to create webhooks pointing to private/internal network addresses…
- risk 0.47cvss 8.3epss 0.00
Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces. This issue has been patched in version 1.3.1.
- risk 0.46cvss 7.1epss 0.01
Plane version 0.7.1-dev allows an attacker to change the avatar of his profile, which allows uploading files with HTML extension that interprets both HTML and JavaScript.
- risk 0.46cvss 7.1epss 0.01
Plane version 0.7.1 allows an unauthenticated attacker to view all stored server files of all users.
- risk 0.43cvss 7.7epss 0.00
Plane is an an open-source project management tool. From 0.28.0 to before 1.3.0, the remediation of GHSA-jcc6-f9v6-f7jw is incomplete which could lead to the same full read Server-Side Request Forgery when a normal html page contains a link tag with an href that redirects to a…
- risk 0.42cvss 7.5epss 0.00
Plane is an an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate workspace members and extract sensitive information including email addresses, user roles, and internal identifiers. The vulnerability stems from Django REST…
- risk 0.35cvss 5.4epss 0.00
Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the description_html field when creating an intake work item through the API v1 intake endpoint.
- risk 0.35cvss 6.5epss 0.00
Plane is an open-source project management tool. In versions 1.3.0 and below, SavedAnalyticEndpoint passes the user-controlled segment query parameter directly to a Django F() expression without validation (unlike the regular AnalyticsEndpoint, which checks against an…
- risk 0.35cvss 6.5epss 0.00
Plane is an an open-source project management tool. Prior to 1.3.0, the IssueBulkUpdateDateEndpoint allows a project member (ADMIN or MEMBER) to modify the start_date and target_date of ANY issue across the entire Plane instance, regardless of workspace or project membership.…
- risk 0.35cvss 5.4epss 0.00
Plane is an open-source project management tool. A cross-site scripting (XSS) vulnerability has been identified in Plane versions prior to 0.23. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets…
- risk 0.28cvss 4.3epss 0.00
Plane is an an open-source project management tool. In plane.io, a guest user doesn't have a permission to access https[:]//app[.]plane[.]so/[:]slug/settings. Prior to Plane version 1.2.0, a problem occurs when the `/api/workspaces/:slug/members/` is accessible by guest and able…
- risk 0.28cvss 5.4epss 0.00
Plane is open-source project management software. Prior to version 0.28.0, a stored cross-site scripting (XSS) vulnerability exists in the description_html field of Plane. This flaw allows an attacker to inject malicious JavaScript code that is stored and later executed in other…
- risk 0.06cvss 2.0epss 0.00
Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address is included as a query parameter in the URL during error handling (e.g., when an invalid magic code is submitted).…
- risk 0.00cvss 6.5epss 0.00
Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one workspace to access, delete, or duplicate assets belonging to another workspace by providing only the victim workspace slug and asset ID. The affected…
Page 1 of 2