Server-Side Request Forgery Vulnerability in Plane Project Management Tool

CVE-2026-39843

What is CVE-2026-39843?

The Plane project management tool, from versions 0.28.0 to before 1.3.0, suffers from an incomplete remediation of a previously identified vulnerability. This flaw allows an authenticated attacker with low privileges to conduct a Server-Side Request Forgery attack. Specifically, the issue arises when a normal HTML page contains a link tag pointing to a private IP address, which an attacker can exploit by supplying it through an 'Add link' feature. Although the redirect validation for the main page URL is enforced, the favicon fetch path remains vulnerable due to the use of requests.get(favicon_url, ...) that does not properly handle redirects. The vulnerability has been addressed in version 1.3.0.

References