CVE-2026-105630: Plane Project Management Tool XSS Vulnerability

CVE-2026-105630 Overview

Plane, an open-source project management tool, contains a stored cross-site scripting (XSS) vulnerability [CWE-79] in versions prior to 1.4.0. An authenticated low-privilege workspace member, including a Guest role, can upload an image/svg+xml file as a generic or issue attachment. The asset-download endpoint generates a presigned URL with Content-Disposition: inline, causing the file to render in the browser. In the default self-hosted MinIO deployment, assets are served from the same origin as the Plane application, allowing embedded SVG JavaScript to execute in the application's security context. The issue is fixed in version 1.4.0.

Critical Impact
A workspace administrator who opens a malicious attachment link can have their session hijacked, resulting in full account takeover and workspace compromise.

Affected Products

Plane (makeplane/plane) versions prior to 1.4.0
Self-hosted Plane deployments using default MinIO object storage
Plane workspaces permitting attachment uploads by Guest or member roles

Discovery Timeline

2026-10-05 - CVE CVE-2026-105630 published to NVD
2026-10-05 - Last updated in NVD database

Technical Details for CVE-2026-105630

Vulnerability Analysis

The vulnerability stems from Plane's asset upload and retrieval pipeline. When a user uploads a file as an attachment, Plane stores the attacker-supplied Content-Type in the asset's attributes without restricting script-capable MIME types. When another user requests the asset, the download endpoint issues a presigned URL with Content-Disposition: inline, instructing the browser to render the content rather than download it.

In default self-hosted deployments, MinIO is served from the same origin as the Plane web application. An SVG file containing a <script> payload therefore executes in the Plane origin's security context. Any JavaScript in the SVG can read session cookies, call authenticated API endpoints, and perform actions as the victim. A Guest-level account is sufficient to plant the payload, and a workspace administrator opening the link can be fully compromised.

Root Cause

Two defects combine to create the vulnerability. First, the asset upload accepts image/svg+xml without stripping embedded scripts or forcing a safe MIME type. Second, the asset-serving code in apps/api/plane/api/views/asset.py and apps/api/plane/app/views/asset/v2.py unconditionally generated a presigned URL with inline disposition. When combined with same-origin asset delivery in the default MinIO setup, this converts any uploaded SVG into stored XSS.

Attack Vector

Exploitation requires an authenticated workspace account with attachment-upload permissions, which includes the Guest role. The attacker uploads a crafted SVG file to a project or issue, then shares or waits for a privileged user to open the asset link. User interaction is required to trigger the payload.

python

# Patch excerpt - apps/api/plane/app/views/asset/v2.py
# Get the presigned URL.
# Force attachment disposition for script-capable MIME types to prevent
# same-origin XSS when assets are served on the application's origin.
storage = S3Storage(request=request)
asset_mime_type = (asset.attributes.get("type") or "").split(";")[0].strip().lower()
disposition = (
    "attachment" if asset_mime_type in settings.SCRIPT_CAPABLE_MIME_TYPES else "inline"
)
# Generate a presigned URL to share an S3 object
signed_url = storage.generate_presigned_url(
    object_name=asset.asset.name,
    disposition=disposition,
)
# Redirect to the signed URL
return HttpResponseRedirect(signed_url)

Source: GitHub Commit 9dff20e

Detection Methods for CVE-2026-105630

Indicators of Compromise

Attachment records in Plane whose attributes.type equals image/svg+xml or other script-capable MIME values
MinIO or S3 access logs showing GET requests to .svg assets with response-content-disposition=inline
Unexpected outbound HTTP requests from administrator browser sessions shortly after opening an attachment link
Workspace audit events showing new API tokens, role changes, or invitations issued from an administrator session without corresponding user action

Detection Strategies

Query the asset database for uploads where the stored MIME type is image/svg+xml and inspect the file contents for <script>, onload, onerror, or javascript: strings
Review reverse-proxy and MinIO logs for asset downloads served with Content-Disposition: inline for SVG objects
Correlate attachment access events with privileged administrative actions occurring in the same session window

Monitoring Recommendations

Alert on new attachment uploads with script-capable MIME types across all workspaces
Monitor for anomalous session activity from administrator accounts after attachment interactions
Track creation of new workspace invitations, personal access tokens, or privilege changes to detect post-exploitation actions

How to Mitigate CVE-2026-105630

Immediate Actions Required

Upgrade all Plane deployments to version 1.4.0 or later without delay
Audit existing attachments for SVG files and quarantine or delete any containing embedded scripts
Rotate session cookies, API tokens, and administrator credentials if SVG attachments were accessible before patching
Review workspace audit logs for suspicious administrative actions originating from attachment access

Patch Information

The fix is included in Plane 1.4.0, released via the GitHub Release v1.4.0. The patch in GitHub Pull Request #9312 adds a SCRIPT_CAPABLE_MIME_TYPES check that forces Content-Disposition: attachment for any asset whose stored MIME type can execute script. See the GitHub Security Advisory GHSA-ch8j-vr4r-qf6h for full disclosure details.

Workarounds

Serve MinIO or S3 assets from a dedicated origin or subdomain distinct from the Plane application origin to prevent same-origin script execution
Place a reverse proxy in front of the asset endpoint that rewrites Content-Disposition to attachment for SVG and other script-capable MIME types
Restrict attachment upload permissions and remove the Guest role from untrusted users until the patch is applied
Configure a Content Security Policy that disallows inline script execution on the Plane application origin

bash

# Example nginx override to force attachment disposition for SVG assets
location ~* \.svg$ {
    add_header Content-Disposition "attachment" always;
    add_header X-Content-Type-Options "nosniff" always;
    proxy_pass http://minio_backend;
}