SOPlanning Unrestricted File Upload Vulnerability Allowing Remote Code Execution

A vulnerability exists in SOPlanning versions through 1.55, allowing authenticated attackers with access to the backup functionality to upload ZIP archives containing malicious files. The application does not properly validate file extensions, enabling the inclusion of harmful files alongside legitimate ones, such as a user.csv file. Once uploaded, the malicious file can be extracted on the server. This vulnerability, when combined with a separate path traversal issue (CVE-2026-40547), could lead to the execution of the malicious file, such as a PHP script, from a web-accessible location.

Impact

Exploitation of this vulnerability could result in remote code execution on the server.