CVE-2025-62716: Plane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path Parameter
Plane is open-source project management software. Prior to version 1.1.0, an open redirect vulnerability in the ?nextpath query parameter allows attackers to supply arbitrary schemes (e.g., javascript:) that are passed directly to router.push. This results in a cross-site scripting (XSS) vulnerability, enabling attackers to execute arbitrary JavaScript in the victim’s browser. The issue can be exploited without authentication and has severe impact, including information disclosure, and privilege escalation and modifications of administrative settings. This issue has been patched in version 1.1.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62716?
CVE-2025-62716 is categorized as a high severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2025-62716?
To fix CVE-2025-62716, upgrade to Plane version 1.1.0 or later, which addresses the open redirect vulnerability.
What causes CVE-2025-62716?
CVE-2025-62716 is caused by an open redirect vulnerability in the ?next_path query parameter that allows arbitrary schemes to be passed to router.push.
Who is affected by CVE-2025-62716?
CVE-2025-62716 affects all users of Plane software prior to version 1.1.0.
What are the potential impacts of CVE-2025-62716?
The potential impacts of CVE-2025-62716 include cross-site scripting attacks that could lead to data theft or user session hijacking.