CVE-2025-21616

Plane has a Cross-site scripting (XSS) via SVG image upload

State: Published
Severity: 5.4 Medium
Published: Jan 6, 2025
Updated: Jan 7, 2025
Reserved: Dec 29, 2024

Description

Plane is an open-source project management tool. A cross-site scripting (XSS) vulnerability has been identified in Plane versions prior to 0.23. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims' browsers when viewing the profile image.

Scores

CVSS	Score	Vector	Source
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	GitHub_M

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
planemakeplane	< 0.23Affected

References

https://github.com/makeplane/plane/security/advisories/GHSA-rcg8-g69v-x23j

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.