CVE-2025-62716

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-62716
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-62716.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-62716
Aliases
  • GHSA-6fj7-xgpg-mj6f
Published
2025-10-24T20:06:18.446Z
Modified
2025-12-02T20:17:35.215212Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Plane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path Parameter
Details

Plane is open-source project management software. Prior to version 1.1.0, an open redirect vulnerability in the ?next_path query parameter allows attackers to supply arbitrary schemes (e.g., javascript:) that are passed directly to router.push. This results in a cross-site scripting (XSS) vulnerability, enabling attackers to execute arbitrary JavaScript in the victim’s browser. The issue can be exploited without authentication and has severe impact, including information disclosure, and privilege escalation and modifications of administrative settings. This issue has been patched in version 1.1.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62716.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-601",
        "CWE-79"
    ]
}
References

Affected packages

Git / github.com/makeplane/plane

Affected ranges

Type
GIT
Repo
https://github.com/makeplane/plane
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e710f5b278ed114b7e1f252333c129e885692e4b
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.1.0"
        }
    ]
}

Affected versions

v0.*

v0.1-dev
v0.10-dev
v0.11-dev
v0.12-dev
v0.12.1-dev
v0.12.2-dev
v0.13-dev
v0.13.1-dev
v0.13.2-dev
v0.14-dev
v0.14.1-dev
v0.14.2-dev
v0.15-dev
v0.15.1-dev
v0.15.2-dev
v0.15.3-hotfix
v0.15.4-dev
v0.16-dev
v0.17-dev
v0.18-dev
v0.19-dev
v0.2-dev
v0.2.1-dev
v0.20-dev
v0.21-dev
v0.22-dev
v0.23.0
v0.23.1
v0.24.0
v0.24.1
v0.25.0
v0.25.1
v0.25.2
v0.25.3
v0.26.0
v0.26.1
v0.27.0
v0.27.1
v0.28.0
v0.3.1-dev
v0.4-dev
v0.5-dev
v0.6-dev
v0.7-dev
v0.7.1-dev
v0.8-dev
v0.9-dev

v1.*

v1.0.0