CVE-2025-21616: Plane has a Cross-site scripting (XSS) via SVG image upload

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-01-06 · updated 2026-06-17
Weakness: CWE-79

Description

Plane is an open-source project management tool. A cross-site scripting (XSS) vulnerability has been identified in Plane versions prior to 0.23. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims' browsers when viewing the profile image.

Affected products

makeplane plane: before 0.23.0 — fixed in 0.23.0

How to fix

Upgrade to a fixed version: makeplane plane 0.23.0. Check the vendor advisory for mitigations.

References

https://github.com/makeplane/plane/security/advisories/GHSA-rcg8-g69v-x23j
https://github.com/makeplane/plane/security/advisories/GHSA-rcg8-g69v-x23j

Get alerted when CVE-2025-21616 or the next vulnerability affects your stack