CVE-2026-40547CWE-22

Path Traversal in SOPlanning

Medium · published June 1, 2026

CVSS v4.0
6.4
EPSS
1%
Percentile
48.1
In the wild
Unconfirmed
What it is

SOPlanning is vulnerable to Path Traversal in backup endpoints. Authenticated remote attacker is able to exploit a vulnerable endpoint and construct payloads that allow reading and executing files previously added through the backup functionality. Critically, due to CVE-2026-40543 (Missing Authorization), any backup file can be read by any (unauthorized) user.

This issue affects SOPlanning version 1.55 and below.

The record
Technical detail
CVSS v4.0
6.4 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H
EPSS
0.00602 · 48.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-06-01T09:04Z
EPSS history
Timeline
  • 01 JUN 09:04Z
    Path Traversal in SOPlanning
    cvelistv5