CVE-2026-39843CWE-918

Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching

High · published April 9, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
27.6
In the wild
Unconfirmed
What it is

Plane is an an open-source project management tool. From 0.28.0 to before 1.3.0, the remediation of GHSA-jcc6-f9v6-f7jw is incomplete which could lead to the same full read Server-Side Request Forgery when a normal html page contains a link tag with an href that redirects to a private IP address is supplied to Add link by an authenticated attacker with low privileges. Redirects for the main page URL are validated, but not the favicon fetch path. fetch_and_encode_favicon() still uses requests.get(favicon_url, ...) with the default redirect-following. This vulnerability is fixed in 1.3.0.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00352 · 27.6th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-04-09T15:43Z
EPSS history
Timeline
  • 09 APR 15:43Z
    Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching
    cvelistv5