CVE-2026-40548

SOPlanning does not verify uploaded file extension. An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a legitimate user.csv file alongside a malicious file, which is extracted on the server. When combined with CVE-2026-40547 (Path Traversal), the malicious file (e.g., a PHP script) can be placed in a web-accessible location and executed via the browser. This issue affects SOPlanning version 1.55 and below.

• CWE-434

• https://cert.pl/en/posts/2026/06/CVE-2026-40543
• https://www.soplanning.org/en/

Published

Jun 1, 2026

Last Modified

Jul 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40542Missing critical step in authentication in Apache HttpClient…7.3
• CVE-2026-40543SOPlanning does not enforce authorization for backup functio…8.8
• CVE-2026-40544SOPlanning is vulnerable to Stored Cross-Site Scripting (XSS…5.1
• CVE-2026-40545SOPlanning is vulnerable to Reflected XSS via the taches par…5.1
• CVE-2026-40546SOPlanning is vulnerable to SQL Injection across multiple en…8.7
• CVE-2026-40547SOPlanning is vulnerable to Path Traversal in backup endpoin…6.4
• CVE-2026-40549SOPlanning is vulnerable to Cross‑Site Request Forgery (CSRF…5.1
• CVE-2026-4055Mattermost versions 11.5.x <= 11.5.1 fail to validate team-l…4.3
• CVE-2026-40550mpGabinet is vulnerable to Privilege Escalation due to exces…6.9
• CVE-2026-40551mpGabinet performs client-side authentication. An attacker w…8.4
• CVE-2026-40552mpGabinet is vulnerable to Remote Command Execution. An auth…4.7
• CVE-2026-40553Buffer overflow vulnerability has been found in "extension/r…7.5