CVE-2026-40544

Name of the Vulnerable Software and Affected Versions SOPlanning versions prior to 1.56

Description Stored Cross-Site Scripting (XSS) occurs via the '/process/upload backup' endpoint. An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a malicious user.csv file with embedded JavaScript. The injected code executes in the victim's browser when the Edit button for the malicious backup is clicked.

Recommendations Update to a version later than 1.55. Restrict access to the '/process/upload backup' endpoint to minimize the risk of exploitation.