CVE-2026-27706: fallo de gravedad alta en makeplane plane
Plane Vulnerable to Full Read SSRF via Favicon Fetching in "Add Link" Feature
Publicada el
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.7epss 0.4%
probabilidad de explotación
0.4%top 70% de las CVE
explotación observada
noninguna fuente lo reporta
Plane is an an open-source project management tool. Prior to version 1.2.2, a Full Read Server-Side Request Forgery (SSRF) vulnerability has been identified in the "Add Link" feature. This flaw allows an authenticated attacker with general user privileges to send arbitrary GET requests to the internal network and exfiltrate the full response body. By exploiting this vulnerability, an attacker can steal sensitive data from internal services and cloud metadata endpoints. Version 1.2.2 fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Productos afectados
makeplane · planeCVEs relacionadas — makeplane plane
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-31461CRITICALPlane Server-Side Request Forgery (SSRF) VulnerabilityEPSS 0.7%CVE-2024-47830CRITICALPlane allows server side request forgery via /_next/image endpointEPSS 0.6%CVE-2026-104974HIGHPlane: Disabled User Auto-Reactivation on LoginEPSS 0.5%CVE-2026-105641CRITICALPlane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypassEPSS 0.5%CVE-2026-105635HIGHPlane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without TokenEPSS 0.4%CVE-2026-30244HIGHPlane: Unauthenticated Workspace Member Information DisclosureEPSS 0.4%