CVE-2026-40544
Deferred Deferred - Pending Action

Stored XSS in SOPlanning via Malicious Backup Upload

Publication date: 2026-06-01

Last updated on: 2026-06-01

Assigner: CERT.PL

Description
SOPlanning is vulnerable to Stored Cross-Site Scripting (XSS) via /process/upload_backup endpoint. An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a malicious user.csv file with embedded JavaScript. The injected code is executed in the victim’s browser when a user clicks the Edit button for the malicious backup. This issue affects SOPlanning version 1.55 and below.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-01
Last Modified
2026-06-01
Generated
2026-07-11
AI Q&A
2026-06-01
EPSS Evaluated
2026-07-10
NVD
CVE-2026-40544
EUVD
EUVD-2026-33610

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
soplanning soplanning to 1.56 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in SOPlanning versions 1.55 and below. An authenticated attacker who has access to the backup functionality can upload a specially crafted ZIP archive containing a malicious user.csv file with embedded JavaScript code. When a user later clicks the Edit button for the malicious backup, the injected JavaScript code executes in the victim's browser.

Impact Analysis

This vulnerability can lead to the execution of malicious JavaScript code in the context of a victim's browser. This can result in unauthorized actions such as stealing session cookies, performing actions on behalf of the user, or delivering further attacks like phishing or malware. Since the attacker must be authenticated and have access to the backup functionality, the risk is limited to users with such privileges, but it can still compromise user data and application integrity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-40544. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart