Executive brief
SOPlanning is an online project management and team scheduling tool. A security vulnerability exists where an authenticated user can upload a malicious backup file that contains hidden computer code. If another user, such as an administrator, attempts to edit this backup, the hidden code will run in their browser, potentially allowing the attacker to steal session information or perform actions on behalf of the victim.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in SOPlanning versions 1.55 and below within the /process/upload_backup endpoint. The application fails to properly sanitize the contents of uploaded backup files. An authenticated attacker can craft a ZIP archive containing a 'user.csv' file with embedded JavaScript payloads. When a victim (typically an administrator) interacts with the malicious backup by clicking the 'Edit' button, the payload is executed in the context of their browser session. This can lead to session hijacking or unauthorized administrative actions. This vulnerability is often combined with other flaws in the same software, such as missing authorization on backup endpoints.
Affected products
- SOPlanning SOPlanning 1.55 and below
Timeline
- 2026-06-01: advisory: Advisory published by CERT.PL and NVD