CVE-2026-105630

8.7 HIGHpublic exploit available

Published 2026-10-05 · Updated 2026-10-05

AI risk analysis

Summary: The flaw allows an authenticated low-privilege user to upload an SVG file that can execute JavaScript, leading to potential session hijacking and account takeover.
Exploitability: Exploitation is moderately hard as it requires an authenticated user with low privileges, but the conditions are easily met in a self-hosted environment.
Blast radius: If exploited, the impact is high, as it can lead to full account compromise for both workspace members and administrators.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Plane version 1.4.0 or later.

xsssvgwebsession-hijack

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment. The file retains the attacker-controlled Content-Type, and the asset-download endpoint creates a presigned URL with Content-Disposition: inline. In the default self-hosted MinIO deployment, the asset URL is served from the same origin as the Plane application, allowing embedded SVG JavaScript to execute in the application's security context. A victim, including a workspace administrator, who opens the link can have the session compromised through stored XSS, leading to account takeover. This issue is fixed in 1.4.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Weaknesses

CWE-79, CWE-434, CWE-616

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.