CVE-2026-105630 in Plane
Summary
by MITRE • 10/05/2026
Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment. The file retains the attacker-controlled Content-Type, and the asset-download endpoint creates a presigned URL with Content-Disposition: inline. In the default self-hosted MinIO deployment, the asset URL is served from the same origin as the Plane application, allowing embedded SVG JavaScript to execute in the application's security context. A victim, including a workspace administrator, who opens the link can have the session compromised through stored XSS, leading to account takeover. This issue is fixed in 1.4.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified in Plane versions prior to 1.4.0 represents a critical Stored Cross-Site Scripting (XSS) flaw rooted in improper validation of file uploads and insecure handling of content types within the application's asset management subsystem. As an open-source project management tool, Plane relies on user-generated content for collaboration, which inherently increases the attack surface if input sanitization is not rigorously enforced. The core technical deficiency lies in the backend logic that processes uploaded files, specifically regarding how it determines and preserves the Content-Type header associated with the file. When a low-privilege workspace member, including users with Guest-level access, uploads an image or issue attachment, the system fails to validate whether the actual content of the file matches its declared MIME type. This allows an attacker to upload a malicious SVG file while retaining the application-controlled Content-Type of image/svg+xml, effectively bypassing any naive extension-based checks that might have been in place.
The exploitation mechanism is further enabled by how the asset-download endpoint generates presigned URLs for accessing these files. In this process, the server sets the HTTP header Content-Disposition to inline rather than attachment when serving the file. This configuration instructs modern web browsers to render the content directly within the browser window instead of prompting a download or opening it in an external viewer. Because many self-hosted deployments of Plane utilize MinIO as their object storage backend and serve static assets from the same origin as the main application, the malicious SVG is served with the plane.application domain's security context. This co-location of origins removes Same-Origin Policy protections that would otherwise isolate the content, allowing any JavaScript embedded within the SVG file to execute directly in the context of the Plane web application.
The operational impact of this vulnerability is severe due to its stored nature and broad accessibility. Once a malicious SVG containing obfuscated or standard XSS payloads is uploaded by an attacker, it remains on the server until manually deleted. Any subsequent user who views the issue or workspace where the file was attached will trigger the execution of the script in their browser session. This includes high-privilege users such as workspace administrators and owners. The successful exploitation leads to a complete compromise of the victim's authenticated session. Attackers can leverage this access to steal sensitive project data, exfiltrate credentials stored in local storage or cookies, perform actions on behalf of the user such as creating new issues or modifying settings, and potentially pivot to attack other systems within the organization if session tokens are reused elsewhere. This constitutes a classic account takeover scenario facilitated by persistent malicious content injection.
From a classification perspective, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting), specifically in its stored variant where user input is not validated before being saved to the database or file system and subsequently rendered without proper encoding. Additionally, it relates to CWE-436: Interpretation Conflict, as the application interprets a file based on its declared type rather than its actual content structure. In terms of offensive security frameworks, this attack vector maps to MITRE ATT&CK technique T1059.007: Command and Scripting Interpreter via JavaScript, which is used here for client-side execution within the browser environment. The lack of strict MIME-type validation also touches upon CWE-434: Unrestricted Upload of File with Dangerous Type, although the primary impact stems from the subsequent rendering context rather than server-side code execution.
To mitigate this vulnerability and prevent similar issues in future deployments or upgrades, organizations must immediately upgrade to Plane version 1.4.0 or later where the issue has been resolved. The fix likely involves implementing strict MIME-type validation that verifies the file content against its declared type using magic number checks rather than relying solely on headers provided by clients. Furthermore, developers should enforce Content-Disposition: attachment for all uploaded files unless there is a specific business requirement to render them inline, and even then, only allow safe formats like standard images with sanitized attributes. Implementing a Content Security Policy (CSP) that restricts script execution origins can also provide an additional layer of defense by preventing the execution of scripts loaded from asset storage domains if they are separated from the application domain. Regular security audits focusing on file upload handlers and content type handling in web applications are essential to maintain resilience against such injection attacks.