← CVE Intelligence

CVE-2026-32095

Plunk has Stored Cross-Site Scripting (XSS) via SVG File Upload PUBLISHED

Description (CNA)

Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.1, Plunk's image upload endpoint accepted SVG files, which browsers treat as active documents capable of executing embedded JavaScript, creating a stored XSS vulnerability. This vulnerability is fixed in 0.7.1.

Affected (CNA)

Vendor / productVersions
useplunk / plunkaffected < 0.7.1

CWE

CWE-79

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.