CVE-2024-47830: Plane allows server side request forgery via /_next/image endpoint

Severity: medium (CVSS 5.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-10-11 · updated 2026-06-17
Weakness: CWE-918

Description

Plane is an open-source project management tool. Plane uses the ** wildcard support to retrieve the image from any hostname as in /web/next.config.js. This may permit an attacker to induce the server side into performing requests to unintended locations. This vulnerability is fixed in 0.23.0.

Affected products

makeplane plane: before 0.23.0 — fixed in 0.23.0

How to fix

Upgrade to a fixed version: makeplane plane 0.23.0. Check the vendor advisory for mitigations.

References

https://github.com/makeplane/plane/commit/b9f78ba42b70461c8c1d26638fa8b9beef6a96a1
https://github.com/makeplane/plane/security/advisories/GHSA-39gx-38xf-c348

Get alerted when CVE-2024-47830 or the next vulnerability affects your stack