Plane is an open-source project management tool

CVE-2025-21616 is a stored XSS bug in Plane's profile-image upload path. In Plane versions earlier than 0.23, an authenticated user can upload an SVG avatar containing JavaScript; that script runs in another user's browser when the victim views the profile or any page that renders that avatar. The affected component is the Plane API service's profile image upload feature, and the vulnerable range is < 0.23 on all deployment platforms.

The vendor's 5.4 MEDIUM rating is defensible in a lab, but a bit generous for enterprise patch triage. The decisive friction is that exploitation already assumes a valid Plane account and then still needs a victim to render the malicious avatar, which makes this a *post-initial-access, user-interaction-dependent* browser-session issue rather than an initial foothold or infrastructure-level compromise path.

Why this verdict

• Start from 5.4 MEDIUM, then cut for attacker position: exploitation requires a valid Plane account (PR:L), which means the attacker is already inside the tenant or has already stolen creds.
• Cut again for mandatory user interaction: this is stored XSS, but the payload still needs another user to load a page rendering the avatar (UI:R), so exploitation is not self-driving at internet scale.
• Cut for bounded blast radius, add back a little for persistence: impact is generally limited to the victim's Plane browser session and privileges, but the payload is stored and can hit multiple viewers over time in collaborative workflows.

Why not higher?

There is no unauthenticated reach, no direct server-side code execution, and no infrastructure takeover path in the advisory. Requiring *both* a logged-in attacker and a victim page view is compounded friction that keeps this out of MEDIUM/HIGH operational urgency for most enterprises.

Why not lower?

This is still a real stored XSS in a shared work-management platform, not a theoretical parser bug. In environments with external guests, contractors, or broadly shared workspaces, a single low-privilege user could target admins or project owners and perform actions in their browser context.

1. Block SVG avatar uploads — Deny image/svg+xml for profile images at the application, reverse proxy, or object-storage ingress layer. For a LOW verdict there is no SLA (treat as backlog hygiene), so do this in the next normal config cycle if you cannot upgrade immediately.
2. Enforce a tight CSP — Add or verify a Content Security Policy that prevents inline script execution and sharply restricts script sources for user-rendered content. This is an effective brake on browser-side payload execution and is the vendor's own fallback recommendation; for LOW, deploy during routine hardening rather than as emergency change.
3. Constrain who can join the workspace — Limit guest invitations, self-signup, and dormant low-trust accounts because the exploit begins with a valid Plane identity. For LOW, there is no mitigation SLA, but this is smart hygiene for any externally shared collaboration stack.
4. Review internet exposure and privileged users — If your Plane instance is exposed beyond VPN or has external collaborators, prioritize checking whether admins and automation users frequently view user profiles or activity feeds. This does not change the formal SLA bucket, but it tells you whether your local risk sits at the top or bottom of that LOW band.

Run this on the Plane host or from an auditor shell with read access to the deployment files; it can inspect a supplied Docker Compose file and, if available, running Docker containers. Invoke it as bash check_plane_cve_2025_21616.sh /opt/plane/docker-compose.yml; root is not required unless your Docker socket is root-only.

#!/usr/bin/env bash
# check_plane_cve_2025_21616.sh
# Detect likely exposure to CVE-2025-21616 in self-hosted Plane deployments.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

THRESHOLD="0.23.0"
COMPOSE_FILE="${1:-}"
FOUND_ANY=0
FOUND_VULN=0
FOUND_UNKNOWN=0

declare -a TAGS

normalize_tag() {
  local t="$1"
  t="${t#v}"
  t="${t%%-*}"
  echo "$t"
}

is_semver_like() {
  [[ "$1" =~ ^[0-9]+\.[0-9]+(\.[0-9]+)?$ ]]
}

version_lt() {
  local a="$1"
  local b="$2"
  [[ "$(printf '%s\n%s\n' "$a" "$b" | sort -V | head -n1)" != "$b" && "$a" != "$b" ]]
}

collect_from_compose() {
  local file="$1"
  [[ -f "$file" ]] || return 0
  while IFS= read -r line; do
    line="$(echo "$line" | sed -E 's/#.*$//')"
    if echo "$line" | grep -Eq 'image:[[:space:]]*.*makeplane/'; then
      img="$(echo "$line" | sed -E 's/.*image:[[:space:]]*//')"
      tag="${img##*:}"
      if [[ "$img" == "$tag" ]]; then
        TAGS+=("UNKNOWN")
      else
        TAGS+=("$tag")
      fi
    fi
  done < "$file"
}

collect_from_docker() {
  if ! command -v docker >/dev/null 2>&1; then
    return 0
  fi

  local images
  images="$(docker ps --format '{{.Image}}' 2>/dev/null | grep 'makeplane/' || true)"
  [[ -n "$images" ]] || return 0

  while IFS= read -r img; do
    [[ -n "$img" ]] || continue
    tag="${img##*:}"
    if [[ "$img" == "$tag" ]]; then
      TAGS+=("UNKNOWN")
    else
      TAGS+=("$tag")
    fi
  done <<< "$images"
}

evaluate_tags() {
  local seen=0
  for raw in "${TAGS[@]}"; do
    seen=1
    FOUND_ANY=1
    if [[ "$raw" == "latest" || "$raw" == "stable" || "$raw" == "dev" || "$raw" == "buildcache" || "$raw" == "UNKNOWN" || -z "$raw" ]]; then
      FOUND_UNKNOWN=1
      continue
    fi

    ver="$(normalize_tag "$raw")"
    if ! is_semver_like "$ver"; then
      FOUND_UNKNOWN=1
      continue
    fi

    # Fixed in 0.23 and later; any 1.x/2.x release is therefore patched.
    if version_lt "$ver" "$THRESHOLD"; then
      FOUND_VULN=1
    fi
  done

  [[ $seen -eq 1 ]] || FOUND_UNKNOWN=1
}

collect_from_compose "$COMPOSE_FILE"
collect_from_docker

evaluate_tags

if [[ $FOUND_VULN -eq 1 ]]; then
  echo "VULNERABLE"
  exit 1
fi

if [[ $FOUND_ANY -eq 1 && $FOUND_UNKNOWN -eq 0 ]]; then
  echo "PATCHED"
  exit 0
fi

echo "UNKNOWN"
exit 2

Sources

1. GitHub advisory GHSA-rcg8-g69v-x23j
2. NVD CVE-2025-21616
3. OSV record for CVE-2025-21616
4. Plane self-hosting editions documentation
5. Plane open-source product page
6. Plane security page
7. Ubuntu tracker for CVE-2025-21616
8. CISA Known Exploited Vulnerabilities Catalog