An incomplete security patch in the Plane project management tool allows authenticated attackers with low privileges to perform Server-Side Request Forgery (SSRF) attacks.

The application fails to properly validate redirect paths when fetching favicons in the fetch_and_encode_favicon function. An authenticated attacker can exploit this by providing a link that redirects to a private IP address, enabling unauthorized internal network requests.

Successful exploitation allows an attacker to bypass network segmentation and interact with internal services that are not exposed to the public internet. Given the CVSS score of 7.7, this represents a significant risk to internal infrastructure confidentiality, potentially exposing sensitive metadata or backend systems to unauthorized access.

Immediate Action: Upgrade to Plane version 1.3.0 or higher to apply the necessary validation logic for favicon fetching.

Proactive Monitoring: Review web application logs for unusual outbound requests originating from the Plane server, specifically targeting internal IP ranges or local loopback addresses.

Compensating Controls: Implement strict egress filtering on the server hosting Plane to prevent unauthorized internal network communication, and ensure the application runs with the least privileges necessary.

Public Exploit Available: Unknown.

This vulnerability presents a clear path for internal network reconnaissance and potential service exploitation. Organizations currently running versions of Plane prior to 1.3.0 should prioritize the update to the latest stable release to eliminate this SSRF vector and secure the internal environment from unauthorized access.