Back to Database
Status published
Critical
CVE-2024-47830
Plane allows server side request forgery via /_next/image endpoint
Vulnerability Description
Plane is an open-source project management tool. Plane uses the ** wildcard support to retrieve the image from any hostname as in /web/next.config.js. This may permit an attacker to induce the server side into performing requests to unintended locations. This vulnerability is fixed in 0.23.0.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-47830
Credits & Attribution
No credits recorded in the NVD database.
References
More from makeplane
View All →CVE-2025-69284
In plane.io, a Guest User to a Workspace can still be able to see list of members
Medium
4.3
CVE-2025-62716
Plane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path Parameter
High
8.1
CVE-2025-55203
Plane Stored XSS in Add Work Item Functionality
Medium
5.4
CVE-2025-48070
Plane has insecure permissions in UserSerializer
Low
3.5
CVE-2025-21616
Plane has a Cross-site scripting (XSS) via SVG image upload
Medium
5.4
Affected Vendor
makeplane
View all reports →Affected Software
plane
Vulnerable Versions:
< 0.23.0
Timeline
Official Publish:
October 11th, 2024
Last Modified:
October 15th, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H