CVE-2026-40547

6.4 Moyenne

Publiée le 01/06/2026 à 11:16 · Modifiée le 22/07/2026 à 09:10 · Analyse NVD reportée · Source : cvd@cert.pl

Description

SOPlanning is vulnerable to Path Traversal in backup endpoints. Authenticated remote attacker is able to exploit a vulnerable endpoint and construct payloads that allow reading and executing files previously added through the backup functionality. Critically, due to CVE-2026-40543 (Missing Authorization), any backup file can be read by any (unauthorized) user. This issue affects SOPlanning version 1.55 and below.

Traduire en français

Produits concernés

SOPlanning

Scores CVSS

Version	Score	Source	Vecteur
4.0	6.4 Moyenne	cvd@cert.pl	`CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`

Faiblesses (CWE)

CWE-22

Références

https://cert.pl/en/posts/2026/06/CVE-2026-40543
https://www.soplanning.org/en/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories