TI-2026-29290 Aliases CVE-2026-40544 GHSA-hgm3-4mgq-cfx8

Stored XSS in SOPlanning

LOW 23CWE-79Published 2026-06-01 · Updated 2026-06-01

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · Low · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

SOPlanning is vulnerable to Stored Cross-Site Scripting (XSS) via /process/upload_backup endpoint. An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a malicious user.csv file with embedded JavaScript. The injected code is executed in the victim’s browser when a user clicks the Edit button for the malicious backup. This issue affects SOPlanning version 1.55 and below.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00295 22nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SOPlanning	SOPlanning	up to 1.55	—	No fix listed	CNA

SOPlanning VendorSOPlanning Affected up to 1.55 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:soplanning:soplanning::::::::	—	—	SOPlanning

cpe:2.3:a:soplanning:soplanning:*:*:*:*:*:*:*:* Versions — — ·SOPlanning

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-40544
2026-10-03 Alias added: GHSA-hgm3-4mgq-cfx8

References

Advisory 1

https://cert.pl/en/posts/2026/06/CVE-2026-40543

Other 1

https://www.soplanning.org/en/

TI-2024-37809 A file upload bypass vulnerability exists in SOPlanning 1.53.00, specifically in… CVSS 3.1CRITICAL 9.8
TI-2024-37810 SOPlanning 1.53.00 is vulnerable to a directory traversal issue in /process/upload.php. CVSS 3.1MEDIUM 6.5
TI-2014-07125 Multiple SQL vulnerabilities exist in planning.php, user_list.php, projets.php… CVSS 3.1CRITICAL 9.8
TI-2014-07128 Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32… CVSS 3.0MEDIUM 5.3
TI-2024-17975 Remote Code Execution through File Upload in SOPlanning before 1.52.02 CVSS 4.0CRITICAL 10.0
TI-2024-17973 Insecure Direct Object Reference to export Database in SOPlanning before 1.52.02 CVSS 4.0CRITICAL 9.3

See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences