Stored XSS Vulnerability in Plunk Email Platform by AWS

CVE-2026-32095

What is CVE-2026-32095?

Plunk, an open-source email platform utilizing AWS SES, had a vulnerability in its image upload functionality that permitted SVG file uploads. This flaw allowed for the execution of embedded JavaScript, leading to a stored XSS vulnerability. The issue has been addressed in version 0.7.1, emphasizing the necessity for users to update their systems to mitigate potential security risks associated with SVG file processing.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References