CVE-2025-62716

Plane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path Parameter

State: Published
Severity: 8.1 High
Published: Oct 24, 2025
Updated: Oct 24, 2025
Reserved: Oct 20, 2025

Description

Plane is open-source project management software. Prior to version 1.1.0, an open redirect vulnerability in the ?next_path query parameter allows attackers to supply arbitrary schemes (e.g., javascript:) that are passed directly to router.push. This results in a cross-site scripting (XSS) vulnerability, enabling attackers to execute arbitrary JavaScript in the victim’s browser. The issue can be exploited without authentication and has severe impact, including information disclosure, and privilege escalation and modifications of administrative settings. This issue has been patched in version 1.1.0.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N	GitHub_M

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

Affected Products

Product	Versions
planemakeplane	< 1.1.0Affected

References

https://github.com/makeplane/plane/security/advisories/GHSA-6fj7-xgpg-mj6f

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.