| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| planka-prebuild.zip | 2026-08-10 | 5.2 MB | |
| README.md | 2026-08-10 | 831 Bytes | |
| v2.2.1 source code.tar.gz | 2026-08-10 | 4.8 MB | |
| v2.2.1 source code.zip | 2026-08-10 | 5.7 MB | |
| Totals: 4 Items | 15.7 MB | 0 | |
PLANKA Community 2.2.1 — Security release
This is an emergency release fixing a security vulnerability. We recommend updating as soon as possible.
Security
- Fixed a path traversal vulnerability (CWE-22) in the JWT-protected static
file routes (
/user-avatars,/background-images,/favicons). On instances using local file storage, an authenticated user could read arbitrary files readable by the PLANKA process. Fixed by enforcing that resolved paths stay within the uploads root. S3-backed storage was not affected.
Reported responsibly by Alpastx — thank you.
Details: [GHSA link]
Full Changelog: https://github.com/plankanban/planka/compare/v2.2.0...v2.2.1