CVE-2026-39843: Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching
Plane is an an open-source project management tool. From 0.28.0 to before 1.3.0, the remediation of GHSA-jcc6-f9v6-f7jw is incomplete which could lead to the same full read Server-Side Request Forgery when a normal html page contains a link tag with an href that redirects to a private IP address is supplied to Add link by an authenticated attacker with low privileges. Redirects for the main page URL are validated, but not the favicon fetch path. fetchandencodefavicon() still uses requests.get(faviconurl, ...) with the default redirect-following. This vulnerability is fixed in 1.3.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39843?
CVE-2026-39843 has been rated with a high severity due to its potential to lead to unauthorized access through Server-Side Request Forgery.
How do I fix CVE-2026-39843?
To mitigate CVE-2026-39843, upgrade Plane to version 1.3.0 or later to ensure the vulnerability is patched.
What impact does CVE-2026-39843 have on my system?
CVE-2026-39843 allows attackers to exploit SSRF vulnerabilities, potentially leading to unauthorized access to internal resources.
Which versions of Plane are affected by CVE-2026-39843?
Versions of Plane from 0.28.0 to before 1.3.0 are affected by CVE-2026-39843.
Is CVE-2026-39843 related to other vulnerabilities?
Yes, CVE-2026-39843 is related to previous remediation efforts noted in GHSA-jcc6-f9v6-f7jw, which were incomplete.