A recent vulnerability in Plane, an open‑source project management application, allows an authenticated attacker with low privileges to exploit an incomplete server‑side request forgery (SSRF) in the favicon fetching process. When an attacker adds a link element that redirects to a private IP via the Add link interface, the backend fetches the referenced favicon using a default HTTP client that follows redirects without validation. This means the server can be instructed to retrieve internal resources, providing read access to potentially sensitive data on internal networks. The flaw, classified as CWE‑918, permits the attacker to read arbitrary internal content as the Plane instance, resulting in confidentiality compromises.

The issue affects Plane versions starting at 0.28.0 up to, but not including, 1.3.0. All installations of makeplane Plane within that range are vulnerable unless protected by additional network controls. Version 1.3.0 and later contain a fix that validates the favicon URL and blocks redirects to private addresses.

The CVSS base score is 7.7, indicating high severity. No EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated but only with low privileges and to create a link that triggers the SSRF. If internal network defenses permit outbound requests and the application does not restrict target URLs, an attacker could read files, query internal services, or exfiltrate data. Given the lack of high complexity or privilege escalation, the risk is primarily exposure of internal resources; however, the potential impact is significant for sensitive infrastructure.