EUVD-2026-33614
GHSA-r6jh-29f2-qhv2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
SOPlanning does not verify uploaded file extension. An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a legitimate user.csv file alongside a malicious file, which is extracted on the server. When combined with CVE-2026-40547 (Path Traversal), the malicious file (e.g., a PHP script) can be placed in a web-accessible location and executed via the browser.
This issue affects SOPlanning version 1.55 and below.
AnalysisAI
Unrestricted file upload in SOPlanning's backup import functionality (versions 1.55 and below) allows an authenticated high-privilege attacker to smuggle a malicious PHP script inside a crafted ZIP archive alongside a legitimate user.csv file, bypassing extension validation entirely. This vulnerability is materially escalated when chained with CVE-2026-40547 (Path Traversal in the same product), which redirects extraction to a web-accessible directory, converting an upload flaw into full server-side remote code execution. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the exploitation chain is technically straightforward once administrative credentials are held.
Technical ContextAI
SOPlanning is an open-source PHP-based project scheduling and resource planning web application. Its backup restore functionality accepts ZIP archives for import but performs no validation on the file extensions of archive members prior to extraction, satisfying CWE-434 (Unrestricted Upload of File with Dangerous Type). Because the underlying PHP runtime will execute any .php file reachable under the web root, placing a PHP script in an accessible directory is sufficient for code execution. The critical enabler is the path traversal flaw in CVE-2026-40547, which allows the attacker to influence where extracted archive contents are written - without this secondary flaw, the malicious file would be confined to a non-web-accessible backup staging directory and would not be executable by the web server. The attack surface is the backup import HTTP endpoint, and the attack requires the attacker's session to have privileges over that feature (PR:H per CVSS 4.0). No CPE string was provided in the input data, but the product is identifiable via the vendor advisory at https://www.soplanning.org/en/.
RemediationAI
The primary remediation is to upgrade SOPlanning to a version above 1.55, which is expected to address both CVE-2026-40548 and the chained CVE-2026-40547. Consult the vendor release page at https://www.soplanning.org/en/ for the specific patched release version - an exact fix version was not confirmed in the available data. If immediate patching is not feasible, restrict access to the backup import and restore functionality to the smallest possible set of trusted accounts, ideally via application-level role controls or network-layer firewall rules blocking the backup endpoint from general access. Additionally, configure the web server (e.g., Apache or nginx) to deny PHP script execution within any directory used for archive extraction or file uploads, using directives such as php_flag engine off or a location block with deny; - note this may require identifying and hardcoding those paths, and misconfiguration could break legitimate backup functionality. Reducing the attack surface by placing SOPlanning behind a VPN or IP allowlist further limits exposure for PR:H vulnerabilities where credential compromise is the prerequisite attack path.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today