Back to Database
Status published
Medium
CVE-2025-21616
Plane has a Cross-site scripting (XSS) via SVG image upload
Vulnerability Description
Plane is an open-source project management tool. A cross-site scripting (XSS) vulnerability has been identified in Plane versions prior to 0.23. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims' browsers when viewing the profile image.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-21616
Credits & Attribution
No credits recorded in the NVD database.
More from makeplane
View All →CVE-2025-69284
In plane.io, a Guest User to a Workspace can still be able to see list of members
Medium
4.3
CVE-2025-62716
Plane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path Parameter
High
8.1
CVE-2025-55203
Plane Stored XSS in Add Work Item Functionality
Medium
5.4
CVE-2025-48070
Plane has insecure permissions in UserSerializer
Low
3.5
CVE-2024-47830
Plane allows server side request forgery via /_next/image endpoint
Critical
9.3
Affected Vendor
makeplane
View all reports →Affected Software
plane
Vulnerable Versions:
< 0.23
Timeline
Official Publish:
January 6th, 2025
Last Modified:
January 7th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N