CERT Polska disclosed seven vulnerabilities in SOPlanning ≤1.55, including…
CERT Polska disclosed seven vulnerabilities in SOPlanning ≤1.55, including unauthenticated backup retrieval exposing credentials, SQL injection, and remote code execution via path traversal.
CERT Polska coordinated the disclosure of multiple critical vulnerabilities in SOPlanning software version 1.55 and below. The most severe issue is CVE-2026-40543, which allows unauthenticated attackers to access backup endpoints and retrieve database archives containing usernames, password hashes, and sensitive configuration data without any authorization checks. This missing authorization control compounds other vulnerabilities in the application.
The vulnerability set includes SQL injection across multiple endpoints (CVE-2026-40546) enabling database compromise, path traversal in backup functions (CVE-2026-40547) allowing arbitrary file read and execution, and unrestricted file upload (CVE-2026-40548). When chained together, an attacker can upload malicious PHP scripts through the backup functionality, traverse directories to place them in web-accessible locations, and achieve remote code execution. Additional issues include stored XSS via malicious backup archives (CVE-2026-40544), reflected XSS through the taches parameter (CVE-2026-40545), and CSRF in group management endpoints (CVE-2026-40549).
The vulnerabilities were responsibly reported by Łukasz Jaworski and coordinated through CERT Polska's CVD process. Organizations running SOPlanning should prioritize patching given the unauthenticated nature of the primary vulnerability and the potential for complete system compromise through vulnerability chaining.
Mentioned in this report
Detection guidance
Suspicious PHP File Upload via Backup/Restore Endpoint
Detects HTTP POST requests to backup/restore functionality that include PHP file extensions in multipart upload fields, consistent with webshell deployment via unrestricted file upload chained with path traversal (SOPlanning CVE-2026-40547/CVE-2026-40548). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious PHP File Upload via Backup/Restore Endpoint
id: cebf2714-ea9d-57c6-835b-6f1a6422b14a
status: experimental
description: Detects HTTP POST requests to backup/restore endpoints that carry .php
filenames or path traversal sequences, indicative of malicious file upload chained
with directory traversal to achieve remote code execution as seen in SOPlanning
vulnerability chaining.
references:
- CVE-2026-40547
- CVE-2026-40548
logsource:
category: webserver
detection:
selection_method:
cs-method: POST
selection_path:
cs-uri-stem|contains:
- backup
- sauvegarde
- restore
selection_payload:
cs-uri-query|contains:
- .php
- ..%2f
- ../
condition: selection_method and selection_path and selection_payload
falsepositives:
- Legitimate administrators restoring backups that reference filenames with unusual
extensions
- Automated backup verification tools that pass file paths as parameters
level: high
tags:
- attack.t1505.003
- attack.t1190
author: Vorant
Unauthenticated Access to SOPlanning Backup Archive Endpoint
Detects direct requests to the SOPlanning backup archive retrieval endpoint that succeed without an authenticated session cookie, allowing retrieval of database backups containing credentials (CVE-2026-40543). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated Access to SOPlanning Backup Archive Endpoint
id: 41c7d132-495c-54b9-9c76-b641ac9b6b1a
status: experimental
description: Detects HTTP GET requests to backup/export endpoints returning archive
or SQL files without a valid session/auth cookie, consistent with the missing authorization
check enabling unauthenticated retrieval of sensitive backup archives.
references:
- CVE-2026-40543
logsource:
category: webserver
detection:
selection_uri:
cs-uri-stem|contains:
- backup
- sauvegarde
selection_ext:
cs-uri-stem|endswith:
- .sql
- .zip
- .tar.gz
filter_authenticated:
cs-cookie|contains:
- PHPSESSID
condition: selection_uri and selection_ext and not filter_authenticated
falsepositives:
- Reverse proxies or monitoring tools that strip cookies before logging, causing false
positives on legitimate authenticated sessions
- Scheduled backup jobs invoked server-side without a browser session cookie
level: high
tags:
- attack.t1552.001
- attack.t1190
author: Vorant
Web Server Process Spawning Unix Shell (Possible Webshell RCE)
Detects a web server or PHP-FPM process spawning an interactive shell, a common post-exploitation pattern after a PHP webshell is uploaded via chained SOPlanning vulnerabilities and used to execute OS commands. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Unix Shell (Possible Webshell RCE)
id: ab26e819-06b9-5e63-8d61-cecbd92e9897
status: experimental
description: Detects a shell process (sh, bash, dash) spawned as a child of a web
server or PHP process, which is a strong indicator of remote command execution through
a webshell dropped via file upload and path traversal vulnerabilities.
references:
- CVE-2026-40547
- CVE-2026-40548
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- /apache2/
- /httpd
- php-fpm
- nginx
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
condition: selection_parent and selection_child
falsepositives:
- Legitimate CGI scripts or application health-check scripts that shell out for maintenance
tasks
- Custom PHP applications intentionally invoking shell utilities via exec/system calls
for approved functionality
level: high
tags:
- attack.t1059.004
- attack.t1505.003
- attack.t1190
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-40543
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free