TI-2026-29293 Aliases CVE-2026-40547 GHSA-6g52-vww8-5mh5

Path Traversal in SOPlanning

LOW 29CWE-22Published 2026-06-01 · Updated 2026-06-01

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

SOPlanning is vulnerable to Path Traversal in backup endpoints. Authenticated remote attacker is able to exploit a vulnerable endpoint and construct payloads that allow reading and executing files previously added through the backup functionality. Critically, due to CVE-2026-40543 (Missing Authorization), any backup file can be read by any (unauthorized) user. This issue affects SOPlanning version 1.55 and below.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00447 39th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SOPlanning	SOPlanning	up to 1.55	—	No fix listed	CNA

SOPlanning VendorSOPlanning Affected up to 1.55 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:soplanning:soplanning::::::::	—	—	SOPlanning

cpe:2.3:a:soplanning:soplanning:*:*:*:*:*:*:*:* Versions — — ·SOPlanning

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-40547
2026-10-03 Alias added: GHSA-6g52-vww8-5mh5

References

Advisory 1

https://cert.pl/en/posts/2026/06/CVE-2026-40543

Other 1

https://www.soplanning.org/en/

TI-2024-37809 A file upload bypass vulnerability exists in SOPlanning 1.53.00, specifically in… CVSS 3.1CRITICAL 9.8
TI-2024-37810 SOPlanning 1.53.00 is vulnerable to a directory traversal issue in /process/upload.php. CVSS 3.1MEDIUM 6.5
TI-2014-07125 Multiple SQL vulnerabilities exist in planning.php, user_list.php, projets.php… CVSS 3.1CRITICAL 9.8
TI-2014-07128 Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32… CVSS 3.0MEDIUM 5.3
TI-2024-17975 Remote Code Execution through File Upload in SOPlanning before 1.52.02 CVSS 4.0CRITICAL 10.0
TI-2024-17973 Insecure Direct Object Reference to export Database in SOPlanning before 1.52.02 CVSS 4.0CRITICAL 9.3

See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences