Daniel Hiller
bd487e3f9f
The local file manager joined attacker-controlled path segments into the uploads storage path without ensuring the result stayed under the uploads root. Any authenticated user could read arbitrary files readable by the Planka process (e.g. /etc/passwd, /app/.env) via `../` sequences on the /user-avatars/*, /background-images/* and /favicons/* routes (CWE-22). Resolve the path and enforce it stays within uploadsBasePath, centrally in buildPath so every local file operation is covered. Additionally resolve symlinks in read() and re-check containment, so a symlink inside the root cannot be used to escape it. Reported by Alpesh (github.com/Alpastx).
Key Features
- Collaborative Kanban Boards: Create projects, boards, lists, cards, and manage tasks with an intuitive drag-and-drop interface
- Real-Time Updates: Instant syncing across all users, no refresh needed
- Rich Markdown Support: Write beautifully formatted card descriptions with a powerful markdown editor
- Flexible Notifications: Get alerts through 100+ providers, fully customizable to your workflow
- Multilingual & Easy to Translate: Full internationalization support for a global audience
How to Deploy
PLANKA is easy to install using multiple methods - learn more in the installation guide.
For configuration and environment settings, see the configuration section.
Interested in a hosted or Pro version of PLANKA? Check out the pricing on our website.
Notes App
A testing version of the Notes app is now available on multiple platforms:
- iOS: Join the TestFlight to try the app
- Windows & Android: Download the app here
Contact
For any security issues, please do not create a public issue on GitHub - instead, report it privately by emailing security@planka.group.
Note: We do NOT offer any public support via email, please use GitHub.
Join our community: Get help, share ideas, or contribute on our Discord server.
License
PLANKA is fair-code distributed under the Fair Use License and PLANKA Pro/Enterprise License.
- Source Available: The source code is always visible
- Self-Hostable: Deploy and host it anywhere
- Extensible: Customize with your own functionality
- Enterprise Licenses: Available for additional features and support
For more details, check the License Guide.
Contributing
Found a bug or have a feature request? Check out our Contributing Guide to get started.
For setting up the project locally, see the development section.
Thanks to all our contributors!