A low-privilege, authenticated workspace member can upload an image/svg+xml file that is then served for download with the original Content-Type and an inline disposition. The flaw also involves improper file type validation (CWE-434) and Content-Type injection (CWE-616), resulting in a Stored XSS vulnerability (CWE-79). If the SVG contains JavaScript, it can execute in the browser session of any user opening the link, allowing the attacker to hijack the session cookie and take over the victim account.

The issue exists in all versions of Plane provided by makeplane prior to 1.4.0. The fix is delivered in release 1.4.0 and later. The vulnerability is most exposed on self-hosted deployments that use MinIO to serve stored files from the same origin as the application.

With a CVSS score of 8.7 the vulnerability is considered high severity. An EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated low-privilege user uploading a malicious SVG and a target user opening the download link; the attack requires the asset endpoint to be served from the same origin as the Plane application, which is the default configuration for MinIO. An exploit would allow an attacker to compromise the victim’s session and potentially gain administrative control over the workspace.