CVE-2023-30791: Plane

Medium severity, CVSS 4.6. EPSS: 0.5% chance of exploitation in the next 30 days.

Plane version 0.7.1-dev allows an attacker to change the avatar of his profile, which allows uploading files with HTML extension that interprets both HTML and JavaScript.

Affected products

• Plane Plane: version 0.7.1 only

Published 2023-07-15. Last modified 2026-06-17.