PT-2025-4302 · Plane · Plane

I4Bdullah · Published 2025-01-06 · Updated 2025-01-07 · CVE-2025-21616

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Plane versions prior to 0.23

Description A cross-site scripting (XSS) vulnerability has been identified in Plane. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims' browsers when viewing the profile image.

Recommendations For versions prior to 0.23, update to version 0.23 or later to resolve the issue. As a temporary workaround, consider disabling the ability to upload SVG files as profile images until a patch is available. Restrict access to the profile image feature to minimize the risk of exploitation. Avoid using the profile image feature with SVG files until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-21616

GHSA-RCG8-G69V-X23J

Affected Products

Plane

References · 8

• 🔥 https://github.com/makeplane/plane/security/advisories/GHSA-rcg8-g69v-x23j · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21616.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-21616 · Security Note
• https://osv.dev/vulnerability/CVE-2025-21616 · Vendor Advisory
• https://t.me/thedarkwebinformer/10097 · Telegram Post
• https://twitter.com/CVEnew/status/1876382471073247649 · Twitter Post
• https://t.me/cvedetector/14409 · Telegram Post
• https://twitter.com/i4bdullah/status/1876359130736463912 · Twitter Post