What’s Vulnerable › Vulnerabilities
CVE-2026-39843: Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching
- Severity: high (CVSS 7.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-04-09 · updated 2026-10-25
- Weakness: CWE-918
Description
Plane is an an open-source project management tool. From 0.28.0 to before 1.3.0, the remediation of GHSA-jcc6-f9v6-f7jw is incomplete which could lead to the same full read Server-Side Request Forgery when a normal html page contains a link tag with an href that redirects to a private IP address is supplied to Add link by an authenticated attacker with low privileges. Redirects for the main page URL are validated, but not the favicon fetch path. fetch_and_encode_favicon() still uses requests.get(favicon_url, ...) with the default redirect-following. This vulnerability is fixed in 1.3.0.
Affected products
- makeplane plane: from 0.28.0 before 1.3.0 — fixed in 1.3.0
How to fix
Upgrade to a fixed version: makeplane plane 1.3.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-39843 or the next vulnerability affects your stack