CVE-2026-40548

Name of the Vulnerable Software and Affected Versions SOPlanning versions prior to 1.56

Description An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a legitimate user.csv file and a malicious file. The server extracts these files without verifying the uploaded file extensions. When combined with a Path Traversal issue, the malicious file, such as a PHP script, can be placed in a web-accessible location and executed via the browser.

Recommendations Update SOPlanning to a version newer than 1.55.