CVE-2026-40548 PUBLISHED

Unrestricted Upload of File with Dangerous Type in SOPlanning

Assigner: CERT-PL
Reserved: 14.04.2026 Published: 01.06.2026 Updated: 01.06.2026

SOPlanning does not verify uploaded file extension. An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a legitimate user.csv file alongside a malicious file, which is extracted on the server. When combined with CVE-2026-40547 (Path Traversal), the malicious file (e.g., a PHP script) can be placed in a web-accessible location and executed via the browser.

This issue affects SOPlanning version 1.55 and below.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H
CVSS Score: 6.4

Product Status

Vendor SOPlanning
Product SOPlanning
Versions Default: unaffected
  • affected from 0 to 1.55 (incl.)

Credits

  • Łukasz Jaworski finder

References

Problem Types

  • CWE-434: Unrestricted Upload of File with Dangerous Type CWE