PT-2026-1317 · Planka · Planka

Published 2026-01-05 · Updated 2026-01-05 · CVE-2025-65922

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions PLANKA version 2.0.0

Description The application does not implement X-Frame-Options and CSP frame-ancestors headers, which allows it to be embedded within malicious iframes. This can expose users to phishing attacks through UI Redressing, potentially tricking them into entering sensitive information into overlaid fake forms. The supplier disputes this assessment, stating that SameSite=Strict cookies prevent authentication in cross-origin contexts and the browser’s Same-Origin Policy prevents access to iframe content. They argue that the security outcome depends on user trust in the parent page and that embedding the legitimate page adds no additional risk.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2025-65922

Affected Products

Planka

References · 5

• 🔥 https://github.com/09OHs/CVE/blob/e67290bef68d35980d10fd87c9c4403d8e40fc2c/CVE-2025-65922/CVE-2025-65922.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-65922 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65922 · Vendor Advisory
• https://github.com/plankanban/planka · Note
• https://twitter.com/CVEnew/status/2008251288581210191 · Twitter Post