SOPlanning flaws chain to unauthenticated RCE
Seven vulnerabilities in SOPlanning ≤1.55, including unauthenticated backup access and SQL injection, can be chained to achieve remote code execution.
CERT Polska coordinated disclosure of seven vulnerabilities in the open-source project management tool SOPlanning affecting version 1.55 and earlier. The most severe issue, CVE-2026-40543, allows an unauthenticated attacker to directly query backup endpoints and download database backups containing usernames, password hashes, and a config.csv file with additional sensitive data. Separately, CVE-2026-40546 exposes SQL injection across multiple endpoints and parameters, potentially giving an attacker with low privileges full database control.
The disclosure also details a path traversal flaw (CVE-2026-40547) and a file-upload weakness that skips extension verification (CVE-2026-40548), which when chained together allow an authenticated attacker to upload and execute arbitrary files, including PHP scripts, on the server. Because CVE-2026-40543 removes the authorization check on backup retrieval, this chain can effectively be exploited by an unauthenticated attacker to achieve remote code execution. Additional stored and reflected XSS issues (CVE-2026-40544, CVE-2026-40545) and a CSRF vulnerability in group management endpoints (CVE-2026-40549) round out the report.
No evidence of in-the-wild exploitation is mentioned; this is a coordinated vulnerability disclosure credited to researcher Łukasz Jaworski. Organizations running SOPlanning should apply vendor patches once available and restrict access to backup functionality in the interim.
Mentioned in this report
Detection guidance
SOPlanning Arbitrary File Upload with Path Traversal
Detects HTTP POST requests to SOPlanning file upload endpoints with path traversal sequences and PHP file extensions, indicative of CVE-2026-40547 and CVE-2026-40548 chaining. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SOPlanning Arbitrary File Upload with Path Traversal
description: Detects HTTP POST requests to SOPlanning upload endpoints containing
path traversal sequences (../ or ..\\) combined with PHP or script extensions (CVE-2026-40547
+ CVE-2026-40548). Indicates attempt to place web shell outside intended directory.
tags:
- attack.persistence
- attack.t1505.003
logsource:
category: proxy
product: web
detection:
selection_upload:
c-uri|contains:
- /upload
- /file
- /attachment
cs-method: POST
selection_traversal:
cs-uri-query|contains:
- .php
- .phtml
- .phar
- .jsp
- .jspx
- .aspx
condition: selection_upload and selection_traversal
falsepositives:
- Legitimate file manager utilities within SOPlanning UI testing directory navigation
- Automated backup or migration tools with complex path handling
level: high
id: 51768c25-b425-5040-8399-1c5b69a126e4
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-40543
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free