# CVE-2026-40544: SOPlanning Stored XSS in backup upload functionality

Source: https://junglewise.ai/threats/cve-2026-40544-soplanning-stored-xss-in-backup-upload-functionality  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-40544 · Severity: info · CVSS 5.1 · Published 2026-06-01

SOPlanning is an online project management and team scheduling tool. A security vulnerability exists where an authenticated user can upload a malicious backup file that contains hidden computer code. If another user, such as an administrator, attempts to edit this backup, the hidden code will run in their browser, potentially allowing the attacker to steal session information or perform actions on behalf of the victim.

Technologies: [SOPlanning](https://junglewise.ai/threats/technologies/soplanning). Vendors: [SOPlanning](https://junglewise.ai/threats/vendors/soplanning).

## Quick answers

**Is CVE-2026-40544 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40544 being exploited in the wild.

**How severe is CVE-2026-40544?** Informational severity, with a CVSS score of 5.1, published 1 June 2026.

**Which products and versions are affected?** SOPlanning 1.55 and below.

**Is there a fix for CVE-2026-40544?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-40544 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-40544?** Check whether you run SOPlanning at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in SOPlanning versions 1.55 and below within the /process/upload_backup endpoint. The application fails to properly sanitize the contents of uploaded backup files. An authenticated attacker can craft a ZIP archive containing a 'user.csv' file with embedded JavaScript payloads. When a victim (typically an administrator) interacts with the malicious backup by clicking the 'Edit' button, the payload is executed in the context of their browser session. This can lead to session hijacking or unauthorized administrative actions. This vulnerability is often combined with other flaws in the same software, such as missing authorization on backup endpoints.

## Affected products

- SOPlanning SOPlanning 1.55 and below

## Timeline

- 2026-06-01: advisory: Advisory published by CERT.PL and NVD

## References

- [https://cert.pl/en/posts/2026/06/CVE-2026-40543](https://cert.pl/en/posts/2026/06/CVE-2026-40543)
- [https://www.soplanning.org/en/](https://www.soplanning.org/en/)

## Related threats

- [SOPlanning SQL injection in audit retention configuration](https://junglewise.ai/threats/cve-2026-50644-soplanning-sql-injection-in-audit-retention-configuration)
- [SOPlanning CSRF in groupe_save endpoints](https://junglewise.ai/threats/cve-2026-40549-soplanning-csrf-in-groupe-save-endpoints)
- [SOPlanning unrestricted file upload in backup functionality](https://junglewise.ai/threats/cve-2026-40548-soplanning-unrestricted-file-upload-in-backup-functionality)
- [SOPlanning Path Traversal in backup endpoints](https://junglewise.ai/threats/cve-2026-40547-soplanning-path-traversal-in-backup-endpoints)
- [SOPlanning SQL injection in multiple endpoints](https://junglewise.ai/threats/cve-2026-40546-soplanning-sql-injection-in-multiple-endpoints)