CVE-2026-39843

Plane is an an open-source project management tool. From 0.28.0 to before 1.3.0, the remediation of GHSA-jcc6-f9v6-f7jw is incomplete which could lead to the same full read Server-Side Request Forgery when a normal html page contains a link tag with an href that redirects to a private IP address is supplied to Add link by an authenticated attacker with low privileges. Redirects for the main page URL are validated, but not the favicon fetch path. fetch_and_encode_favicon() still uses requests.get(favicon_url, ...) with the default redirect-following. This vulnerability is fixed in 1.3.0.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/makeplane/plane/security/advisories/GHSA-9fr2-pprw-pp9j	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:plane:plane:*:*:*:*:*:*:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Plane es una herramienta de gestión de proyectos de código abierto. Desde la versión 0.28.0 hasta antes de la 1.3.0, la remediación de GHSA-jcc6-f9v6-f7jw es incompleta, lo que podría llevar a la misma falsificación de petición del lado del servidor de lectura completa cuando una página HTML normal contiene una etiqueta link con un href que redirige a una dirección IP privada es suministrada a Add link por un atacante autenticado con bajos privilegios. Las redirecciones para la URL de la página principal son validadas, pero no la ruta de obtención del favicon. fetch_and_encode_favicon() todavía usa requests.get(favicon_url, ...) con el seguimiento de redirección predeterminado. Esta vulnerabilidad se corrige en la versión 1.3.0.

Information

Published : 2026-04-09 16:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-39843

Mitre link : CVE-2026-39843

CVE.ORG link : CVE-2026-39843

JSON object : View

Products Affected

plane

plane

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-39843", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39843", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T20:05:19.321734Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "makeplane", "product": "plane", "versions": [{"status": "affected", "version": ">= 0.28.0, < 1.3.0"}]}]}], "published": "2026-04-09T16:16:31.087", "references": [{"url": "https://github.com/makeplane/plane/security/advisories/GHSA-9fr2-pprw-pp9j", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Plane is an an open-source project management tool. From 0.28.0 to before 1.3.0, the remediation of GHSA-jcc6-f9v6-f7jw is incomplete which could lead to the same full read Server-Side Request Forgery when a normal html page contains a link tag with an href that redirects to a private IP address is supplied to Add link by an authenticated attacker with low privileges. Redirects for the main page URL are validated, but not the favicon fetch path. fetch_and_encode_favicon() still uses requests.get(favicon_url, ...) with the default redirect-following. This vulnerability is fixed in 1.3.0."}, {"lang": "es", "value": "Plane es una herramienta de gesti\u00f3n de proyectos de c\u00f3digo abierto. Desde la versi\u00f3n 0.28.0 hasta antes de la 1.3.0, la remediaci\u00f3n de GHSA-jcc6-f9v6-f7jw es incompleta, lo que podr\u00eda llevar a la misma falsificaci\u00f3n de petici\u00f3n del lado del servidor de lectura completa cuando una p\u00e1gina HTML normal contiene una etiqueta link con un href que redirige a una direcci\u00f3n IP privada es suministrada a Add link por un atacante autenticado con bajos privilegios. Las redirecciones para la URL de la p\u00e1gina principal son validadas, pero no la ruta de obtenci\u00f3n del favicon. fetch_and_encode_favicon() todav\u00eda usa requests.get(favicon_url, ...) con el seguimiento de redirecci\u00f3n predeterminado. Esta vulnerabilidad se corrige en la versi\u00f3n 1.3.0."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:plane:plane:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3970711C-9965-41A8-97F4-A27EE7B3EF01", "versionEndExcluding": "1.3.0", "versionStartIncluding": "0.28.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}