v3.2.1

FujiwaraChoki/MoneyPrinterV2v3.2.1May 15, 2026by cnkk

AI Summary

This is a critical security patch release that addresses a Remote Code Execution (RCE) vulnerability (CVE-2026-8467) by completely removing the exposed `/storybook` HTTP endpoint.

Key Highlights

Fixes RCE vulnerability affecting Plausible Community Edition versions v3.0 through v3.2.
Removes the `HTTP /storybook` endpoint and associated logic.
Recommended immediate mitigation involves updating to v3.2.1 or blocking the endpoint in reverse proxy configuration.

Breaking Changes

Removal of the `/storybook` HTTP endpoint

New Features

Security patch for CVE-2026-8467 / GHSA-55hg-8qxv-qj4p

Full Release Notes

# Security related update

This patch release **fixes a security vulnerability**[`CVE-2026-8467` / `GHSA-55hg-8qxv-qj4p`](https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-55hg-8qxv-qj4p) affecting the following versions of Plausible Community Edition (image: ghcr.io/plausible/community-edition):
Tags:
- v3.2
- v3.2.0
- v3
- v3.2.0-rc.0
- v3.1
- v3.1.0
- v3.1.0-rc.1
- v3.1.0-rc.0
- v3.0.1
- v3.0
- v3.0.0
- v3.0.0-rc.6
- v3.0.0-rc.5
- v3.0.0-rc.4
- v3.0.0-rc.3
- v3.0.0-rc.2
- v3.0.0-rc.1
- v3.0.0-rc.0

The affected versions expose a `HTTP "/storybook"` endpoint which, under certain conditions, allows remote code execution with privileges of system user running the application.

This release v3.2.1 of Plausible Community Edition completely removes that endpoint.

## Who is affected?

All deployments of Plausible Community Edition running the following versions:

- v3.2
- v3.2.0
- v3
- v3.2.0-rc.0
- v3.1
- v3.1.0
- v3.1.0-rc.1
- v3.1.0-rc.0
- v3.0.1
- v3.0
- v3.0.0
- v3.0.0-rc.6
- v3.0.0-rc.5
- v3.0.0-rc.4
- v3.0.0-rc.3
- v3.0.0-rc.2
- v3.0.0-rc.1
- v3.0.0-rc.0

where `HTTP "/storybook"` endpoint is exposed to a public or other untrusted network.

## Mitigation

All affected versions of Plausible Community Edition should be updated to v3.2.1 as soon as possible.

As an immediate mitigation, it is recommended to block access to HTTP "/storybook" endpoint in your reverse proxy configuration or via other applicable means.

## Changes in this release

- Remove `HTTP "/storybook"` endpoint along with the associated logic

No other changes are included in this release.