Vulnerabilities in SOPlanning software

CERT Polska has received a report about vulnerabilities in SOPlanning software and participated in coordination of their disclosure.

The vulnerabilityCVE-2026-40543: SOPlanning does not enforce authorization for backup functionalities. An unauthenticated attacker can directly query backup-related endpoints and retrieve backup archives containing user databases with usernames and password hashes, as well as the config.csv file, which includes additional sensitive information.

The vulnerabilityCVE-2026-40544: SOPlanning is vulnerable to Stored Cross-Site Scripting (XSS) via/process/upload_backupendpoint. An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a malicious user.csv file with embedded JavaScript. The injected code is executed in the victim’s browser when a user clicks the Edit button for the malicious backup.

The vulnerabilityCVE-2026-40545: SOPlanning is vulnerable to Reflected XSS via thetachesparameter. An attacker can craft a malicious URL which, when opened by authenticated victim, results in arbitrary JavaScript execution in the victim’s browser.

The vulnerabilityCVE-2026-40546: SOPlanning is vulnerable to SQL Injection across multiple endpoints and parameters. Attacker with low privileges can inject arbitrary SQL commands, potentially gaining full control over the database.

The vulnerabilityCVE-2026-40547: SOPlanning is vulnerable to Path Traversal in backup endpoints. Authenticated remote attacker is able to exploit a vulnerable endpoint and construct payloads that allow reading and executing files previously added through the backup functionality. Critically, due to CVE-2026-40543 (Missing Authorization), any backup file can be read by any (unauthorized) user.

The vulnerabilityCVE-2026-40548: SOPlanning does not verify uploaded file extension. An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a legitimate user.csv file alongside a malicious file, which is extracted on the server. When combined with CVE-2026-40547 (Path Traversal), the malicious file (e.g., a PHP script) can be placed in a web-accessible location and executed via the browser.

The vulnerabilityCVE-2026-40549: SOPlanning is vulnerable to Cross‑Site Request Forgery (CSRF) ingroupe_savecreate, modify and delete endpoints. An attacker can craft a malicious website that, when visited by an authenticated user, automatically sends a forged GET or POST request to the application.

These issues affect SOPlanning version 1.55 and below.

We thank Łukasz Jaworski for the responsible vulnerability report.