Plane versions >= 0.28.0 and < 1.3.0 contain an SSRF vulnerability due to incomplete remediation of a prior issue (GHSA-jcc6-f9v6-f7jw). While redirects for the main page URL are validated, the favicon fetch path is not, as fetch_and_encode_favicon() uses requests.get() with default redirect-following behavior. This allows an authenticated attacker with low privileges to cause the server to make requests to internal/private IP addresses by supplying a specially crafted HTML page with a link tag whose href redirects internally. The vulnerability is resolved in version 1.3.0.

An attacker with low privileges who is authenticated can exploit this SSRF vulnerability to make the server perform unauthorized requests to internal or private IP addresses. This can lead to disclosure of sensitive internal resources (full read impact). There is no indication of integrity or availability impact. No known exploits in the wild have been reported.

This vulnerability is fixed in Plane version 1.3.0. Users should upgrade to version 1.3.0 or later to remediate this issue. Patch status is not explicitly confirmed in the vendor advisory content provided, but the description states the vulnerability is fixed in 1.3.0. Until upgrading, avoid supplying untrusted HTML content with link tags that could trigger SSRF via favicon fetching.