Veille CVE

‹ Retour à la liste

CVE-2026-105630

8.7 Élevée

Publiée le 05/10/2026 à 20:17 · Modifiée le 05/10/2026 à 21:17 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment. The file retains the attacker-controlled Content-Type, and the asset-download endpoint creates a presigned URL with Content-Disposition: inline. In the default self-hosted MinIO deployment, the asset URL is served from the same origin as the Plane application, allowing embedded SVG JavaScript to execute in the application's security context. A victim, including a workspace administrator, who opens the link can have the session compromised through stored XSS, leading to account takeover. This issue is fixed in 1.4.0.

Traduire en français

Produits concernés

Scores CVSS

VersionScoreSourceVecteur
3.1 8.7 Élevée security-advisories@github.com CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Faiblesses (CWE)

Références

Ailleurs