Is CVE-2026-40547 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40547 being exploited in the wild.

How severe is CVE-2026-40547?

Informational severity, with a CVSS score of 6.4, published 1 June 2026.

Is there a fix for CVE-2026-40547?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-40547 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-40547?

Check whether you run SOPlanning at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40547: SOPlanning Path Traversal in backup endpoints

CVE-2026-40547 · Severity: info · CVSS 6.4 · Published 2026-06-01

SOPlanning, an online project management and team scheduling tool, is vulnerable to a security flaw in its backup system. An attacker can exploit this to access and execute sensitive files on the server, potentially leading to a full system compromise. Because of a related authorization flaw, even users without administrative privileges may be able to access these backup files, risking the exposure of company databases and configuration details.

Technologies: SOPlanning. Vendors: SOPlanning.

Quick answers

Is CVE-2026-40547 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40547 being exploited in the wild.
How severe is CVE-2026-40547?: Informational severity, with a CVSS score of 6.4, published 1 June 2026.
Which products and versions are affected?: SOPlanning 1.55 and below.
Is there a fix for CVE-2026-40547?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-40547 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-40547?: Check whether you run SOPlanning at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Path Traversal vulnerability (CWE-22) exists in the backup endpoints of SOPlanning versions 1.55 and below. An authenticated remote attacker can construct malicious payloads to read or execute files previously handled by the backup functionality. The risk is significantly escalated by a concurrent Missing Authorization vulnerability (CVE-2026-40543), which allows unauthenticated or unauthorized users to query these endpoints. When chained with other flaws like CVE-2026-40548 (Unrestricted File Upload), an attacker can achieve remote code execution by placing and executing malicious PHP scripts in web-accessible directories.

Affected products

SOPlanning SOPlanning 1.55 and below

Timeline

2026-06-01: disclosed: Vulnerability disclosed by CERT Polska
2026-06-01: advisory: NVD record published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.