Threats tagged 'cwe-616'

Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment. The file retains the attacker-controlled Content-Type, and the asset-download endpoint creates a presigned URL with Content-Disposition: inline. In the default self-hosted MinIO deployment, the asset URL is served from the same origin as the Plane application, allowing embedded SVG JavaScript to execute in the application's security context. A victim, including a workspace administrator, who opens the link can have the session compromised through stored XSS, leading to account takeover. This issue is fixed in 1.4.0.

CVE-2026-22789 is a medium-severity vulnerability in SMEWebify's WebErpMesv2 versions prior to 1.19 that allows authenticated users to bypass file upload validation and upload arbitrary files, including PHP scripts. This can lead to remote code execution (RCE) on the affected system. The flaw exists in multiple controllers and is similar to CVE-2025-52130 but in different code locations not fixed previously. Exploitation requires authentication but no user interaction beyond that. The vulnerability impacts confidentiality and integrity but not availability, with a CVSS score of 5.4. No known exploits are currently reported in the wild. European organizations using WebErpMesv2 in manufacturing or resource management should prioritize upgrading to version 1.19 or later to mitigate risk.