Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.4
Plunk Email Platform Allows Malicious SVG Files to Be Uploaded
CVE-2026-32095
Summary
Plunk's image upload feature allowed attackers to upload malicious SVG files, which could execute code on users' browsers. This could lead to unauthorized access to user data and compromise email security. Update to version 0.7.1 or later to fix this issue.
Original title
Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.1, Plunk's image upload endpoint accepted SVG files, which browsers treat as active documents capable of executing embed...
Original description
Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.1, Plunk's image upload endpoint accepted SVG files, which browsers treat as active documents capable of executing embedded JavaScript, creating a stored XSS vulnerability. This vulnerability is fixed in 0.7.1.
nvd CVSS3.1
5.4
Vulnerability type
CWE-79
Cross-site Scripting (XSS)
Published: 11 Mar 2026 · Updated: 14 Mar 2026 · First seen: 11 Mar 2026