CVE-2025-62716: Plane Project Management XSS Vulnerability

CVE-2025-62716 Overview

CVE-2025-62716 is an open redirect and cross-site scripting (XSS) vulnerability in Plane, an open-source project management application. Versions prior to 1.1.0 accept arbitrary URL schemes through the ?next_path query parameter and pass the value directly to router.push. Attackers can supply schemes such as javascript: to execute arbitrary JavaScript in a victim's browser. The flaw requires no authentication and only minimal user interaction to trigger. Successful exploitation enables session theft, information disclosure, modification of administrative settings, and privilege escalation. The maintainers patched the issue in Plane version 1.1.0.

Critical Impact

Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser by crafting a malicious next_path value, leading to account takeover and changes to administrative settings.

Affected Products

• Plane (makeplane/plane) versions prior to 1.1.0
• Self-hosted Plane deployments using vulnerable releases
• Cloud or container-based Plane instances that have not upgraded to 1.1.0

Discovery Timeline

• 2025-10-24 - CVE-2025-62716 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-62716

Vulnerability Analysis

The vulnerability resides in Plane's client-side redirect handling. The application reads a user-controlled next_path query parameter and forwards it to the Next.js router.push function without validating the URL scheme. When router.push receives a value beginning with javascript:, the browser executes the supplied script in the context of the Plane origin.

This behavior converts a classic open redirect into a stored-context XSS primitive. Because Plane is a project management platform, the executing script runs with the privileges of whichever user clicks the crafted link, including administrators. Attackers can read session tokens, issue API calls, exfiltrate project data, and toggle administrative configuration.

The weakness is classified under CWE-79, Improper Neutralization of Input During Web Page Generation. Exploitation requires the victim to click a link, satisfying the User Interaction requirement in the CVSS vector, but no prior authentication on the attacker side is needed.

Root Cause

The next_path parameter is consumed as a trusted redirect target. The router function does not enforce an allowlist of schemes such as http and https, nor does it ensure the value resolves to a same-origin relative path. As a result, any scheme the browser supports, including javascript: and data:, reaches router.push and executes.

Attack Vector

An attacker crafts a URL pointing to a Plane endpoint that processes next_path, embedding a javascript: payload in the parameter. The attacker delivers the link through phishing email, chat, or an embedded reference inside an existing Plane workspace. When a logged-in user opens the link, the payload runs in their browser session and can perform any action available to that user via the Plane web UI or API.

No verified public exploit code is published for this issue. See the GitHub Security Advisory for the maintainers' technical description.

Detection Methods for CVE-2025-62716

Indicators of Compromise

• HTTP requests to Plane endpoints containing next_path=javascript: or other non-http(s) schemes in the query string
• URL-encoded variants such as next_path=javascript%3A or next_path=data%3A in proxy and web server access logs
• Unexpected administrative configuration changes performed shortly after a user opened an external link
• Outbound requests from browsers to attacker-controlled domains correlated with Plane session activity

Detection Strategies

• Inspect reverse proxy and load balancer logs for next_path values that do not start with / or a permitted host
• Deploy a web application firewall rule that blocks query parameters containing javascript:, data:, or vbscript: schemes
• Hunt browser telemetry for script execution originating from the Plane origin immediately after navigation events
• Correlate Plane audit logs for privilege changes with preceding redirect requests carrying next_path

Monitoring Recommendations

• Forward Plane application logs, reverse proxy logs, and browser-side error telemetry to a centralized logging platform
• Alert on first-seen next_path values per user and on values exceeding a baseline length
• Monitor administrator account activity for setting modifications occurring outside expected change windows

How to Mitigate CVE-2025-62716

Immediate Actions Required

• Upgrade Plane to version 1.1.0 or later on all self-hosted and cloud-managed instances
• Invalidate active sessions and rotate API tokens for any user who may have clicked a suspicious link
• Review administrative settings, workspace memberships, and integration credentials for unauthorized changes
• Communicate the issue to workspace administrators and instruct them to avoid clicking external Plane links until patched

Patch Information

The maintainers fixed the vulnerability in Plane 1.1.0 by validating the next_path parameter before passing it to router.push. Refer to the GitHub Security Advisory GHSA-6fj7-xgpg-mj6f for commit details and release notes.

Workarounds

• Block requests at the reverse proxy where the next_path query parameter does not begin with a / character
• Apply a Content Security Policy that disallows inline script execution and restricts script sources to trusted origins
• Restrict Plane access to authenticated users on a VPN or zero-trust gateway until the patch is deployed

# Example NGINX rule to drop requests with non-relative next_path values
if ($arg_next_path !~* "^/[A-Za-z0-9_\-/]*$") {
    return 400;
}