Executive brief
SOPlanning, an online project management and team scheduling tool, is vulnerable to a security flaw in its backup system. An attacker can exploit this to access and execute sensitive files on the server, potentially leading to a full system compromise. Because of a related authorization flaw, even users without administrative privileges may be able to access these backup files, risking the exposure of company databases and configuration details.
Technical details
A Path Traversal vulnerability (CWE-22) exists in the backup endpoints of SOPlanning versions 1.55 and below. An authenticated remote attacker can construct malicious payloads to read or execute files previously handled by the backup functionality. The risk is significantly escalated by a concurrent Missing Authorization vulnerability (CVE-2026-40543), which allows unauthenticated or unauthorized users to query these endpoints. When chained with other flaws like CVE-2026-40548 (Unrestricted File Upload), an attacker can achieve remote code execution by placing and executing malicious PHP scripts in web-accessible directories.
Affected products
- SOPlanning SOPlanning 1.55 and below
Timeline
- 2026-06-01: disclosed: Vulnerability disclosed by CERT Polska
- 2026-06-01: advisory: NVD record published