SOPlanning flaws chain to unauthenticated RCE
Seven vulnerabilities in SOPlanning ≤1.55, including unauthenticated backup access and SQL injection, can be chained to achieve remote code execution.
Sourcecert.pl — open the original
What to check
- Applies to
- The 7 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of seven vulnerabilities in the open-source project management tool SOPlanning affecting version 1.55 and earlier. The most severe issue, CVE-2026-40543, allows an unauthenticated attacker to directly query backup endpoints and download database backups containing usernames, password hashes, and a config.csv file with additional sensitive data. Separately, CVE-2026-40546 exposes SQL injection across multiple endpoints and parameters, potentially giving an attacker with low privileges full database control.
The disclosure also details a path traversal flaw (CVE-2026-40547) and a file-upload weakness that skips extension verification (CVE-2026-40548), which when chained together allow an authenticated attacker to upload and execute arbitrary files, including PHP scripts, on the server. Because CVE-2026-40543 removes the authorization check on backup retrieval, this chain can effectively be exploited by an unauthenticated attacker to achieve remote code execution. Additional stored and reflected XSS issues (CVE-2026-40544, CVE-2026-40545) and a CSRF vulnerability in group management endpoints (CVE-2026-40549) round out the report.
No evidence of in-the-wild exploitation is mentioned; this is a coordinated vulnerability disclosure credited to researcher Łukasz Jaworski. Organizations running SOPlanning should apply vendor patches once available and restrict access to backup functionality in the interim.
Mentioned in this report
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-40543
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs