CVE-2026-39843

Plane is an an open-source project management tool. From 0.28.0 to before 1.3.0, the remediation of GHSA-jcc6-f9v6-f7jw is incomplete which could lead to the same full read Server-Side Request Forgery when a normal html page contains a link tag with an href that redirects to a private IP address is supplied to Add link by an authenticated attacker with low privileges. Redirects for the main page URL are validated, but not the favicon fetch path. fetch_and_encode_favicon() still uses requests.get(favicon_url, ...) with the default redirect-following. This vulnerability is fixed in 1.3.0.

• CWE-918

• https://github.com/makeplane/plane/security/advisories/GHSA-9fr2-pprw-pp9jExploit, Vendor Advisory

Published

Apr 9, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39838Improper neutralization of input during web page generation …6.9
• CVE-2026-39839Improper neutralization of Script-Related HTML tags in a web…6.1
• CVE-2026-3984A weakness has been identified in Campcodes Division Regiona…3.5
• CVE-2026-39840Improper neutralization of input during web page generation …6.1
• CVE-2026-39841Improper neutralization of Script-Related HTML tags in a web…6.1
• CVE-2026-39842OpenRemote is an open-source IoT platform. Versions 1.21.0 a…9.9
• CVE-2026-39844NiceGUI is a Python-based UI framework. Prior to 3.10.0, Sin…7.5
• CVE-2026-39845Weblate is a web based localization tool. In versions prior …4.1
• CVE-2026-39846SiYuan is a personal knowledge management system. Prior to 3…9
• CVE-2026-39847Emmett is a full-stack Python web framework designed with si…7.5
• CVE-2026-39848Dockyard is a Docker container management app. Prior to 1.1.…5.4
• CVE-2026-39849Pi-hole FTL is the core engine of the Pi-hole network-level …8.8