CVE-2026-32095

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-32095
Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.1, Plunk's image upload endpoint accepted SVG files, which browsers treat as active documents capable of executing embedded JavaScript, creating a stored XSS vulnerability. This vulnerability is fixed in 0.7.1.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/useplunk/plunk/security/advisories/GHSA-69jg-7493-cx5x Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:useplunk:plunk:*:*:*:*:*:*:*:*
History

16 Mar 2026, 17:10

Type Values Removed Values Added
References () https://github.com/useplunk/plunk/security/advisories/GHSA-69jg-7493-cx5x - () https://github.com/useplunk/plunk/security/advisories/GHSA-69jg-7493-cx5x - Vendor Advisory
First Time Useplunk
Useplunk plunk
CPE cpe:2.3:a:useplunk:plunk:*:*:*:*:*:*:*:*
Summary
  • (es) Plunk es una plataforma de correo electrónico de código abierto construida sobre AWS SES. Antes de la versión 0.7.1, el punto final de carga de imágenes de Plunk aceptaba archivos SVG, que los navegadores tratan como documentos activos capaces de ejecutar JavaScript incrustado, creando una vulnerabilidad de XSS almacenado. Esta vulnerabilidad está corregida en la versión 0.7.1.

11 Mar 2026, 20:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-11 20:16

Updated : 2026-03-16 17:10

NVD link : CVE-2026-32095

Mitre link : CVE-2026-32095

CVE.ORG link : CVE-2026-32095

JSON object : View

Products Affected

useplunk

  • plunk
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')