Plane CVE-2026-105630

Requires (1) the default self-hosted deployment where Plane assets are served by MinIO from the same origin as the application - a configuration that segregates assets onto a separate origin or CDN neutralizes the same-origin script execution; (2) a valid authenticated account with at least low-privilege/Guest workspace membership able to create issue or generic attachments; and (3) user interaction - a victim (e.g., a workspace administrator) must open the attacker-supplied asset-download link, which serves the SVG with Content-Disposition: inline. The attack hinges on the server retaining the attacker-controlled image/svg+xml Content-Type on upload. These factors - authenticated upload access, dependence on the default MinIO same-origin setup, and required victim interaction - meaningfully limit exploitation below a fully unauthenticated drive-by, though SVGs with onload handlers or embedded <script> make the payload trivial once conditions are met.

This is a genuine, well-corroborated medium-to-high priority for anyone running self-hosted Plane, though not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C) describes a network-reachable, low-complexity stored XSS that requires only low-privilege authentication (a Guest workspace member suffices) but does require a victim to open the malicious link, and the scope change (S:C) plus C:H/I:H reflects that code executing in the app origin can hijack a session up to and including an administrator - yielding the 8.7 base score. Exploitation status is 'no public exploit identified at time of analysis': the input provides no EPSS score, no CISA KEV listing, and no POC flag, so there is no evidence of active or widespread exploitation despite the high CVSS. The signals are internally consistent (no conflict between the network vector and the description), and the fix is confirmed by a vendor GHSA advisory, a merged PR with a code diff, a commit, and the v1.4.0 release. The main caveats that lower real-world urgency: exploitation depends on the default self-hosted MinIO deployment where assets share the app origin (a hardened/separate-origin or CDN asset setup breaks the same-origin execution), and it requires both a valid low-privilege account and successful social engineering of a victim to open the attachment. Net: treat as a real priority for default MinIO self-hosted installs, lower for installs that already segregate the asset origin.

An attacker who holds any low-privilege account - even a Guest - on a self-hosted Plane workspace uploads a crafted image/svg+xml file containing embedded JavaScript as an issue or generic attachment, which preserves the attacker's Content-Type. They share the asset-download link with a workspace administrator; when the admin opens it, the presigned URL serves the SVG inline from the app's own origin, executing the script in the Plane security context and allowing session theft and account takeover. No public exploit code is identified at time of analysis, but the mechanism is straightforward and the fixing diff publicly documents the exact vector.