TI-2026-29294 Aliases CVE-2026-40548 GHSA-r6jh-29f2-qhv2

Unrestricted Upload of File with Dangerous Type in SOPlanning

LOW 28CWE-434Published 2026-06-01 · Updated 2026-06-01

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: None · Low · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

SOPlanning does not verify uploaded file extension. An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a legitimate user.csv file alongside a malicious file, which is extracted on the server. When combined with CVE-2026-40547 (Path Traversal), the malicious file (e.g., a PHP script) can be placed in a web-accessible location and executed via the browser. This issue affects SOPlanning version 1.55 and below.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0031 23rd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SOPlanning	SOPlanning	up to 1.55	—	No fix listed	CNA

SOPlanning VendorSOPlanning Affected up to 1.55 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:soplanning:soplanning::::::::	—	—	SOPlanning

cpe:2.3:a:soplanning:soplanning:*:*:*:*:*:*:*:* Versions — — ·SOPlanning

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-40548
2026-10-03 Alias added: GHSA-r6jh-29f2-qhv2

References

Advisory 1

https://cert.pl/en/posts/2026/06/CVE-2026-40543

Other 1

https://www.soplanning.org/en/

TI-2024-37809 A file upload bypass vulnerability exists in SOPlanning 1.53.00, specifically in… CVSS 3.1CRITICAL 9.8
TI-2024-37810 SOPlanning 1.53.00 is vulnerable to a directory traversal issue in /process/upload.php. CVSS 3.1MEDIUM 6.5
TI-2014-07125 Multiple SQL vulnerabilities exist in planning.php, user_list.php, projets.php… CVSS 3.1CRITICAL 9.8
TI-2014-07128 Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32… CVSS 3.0MEDIUM 5.3
TI-2024-17975 Remote Code Execution through File Upload in SOPlanning before 1.52.02 CVSS 4.0CRITICAL 10.0
TI-2024-17973 Insecure Direct Object Reference to export Database in SOPlanning before 1.52.02 CVSS 4.0CRITICAL 9.3

See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences