SOPlanning allows authenticated users to upload a ZIP archive through the backup feature without checking the file extension or the contents of the archive. During extraction, the application writes files to the server’s file system, and when used together with a Path Traversal vulnerability (CVE‑2026‑40547) attackers can place a malicious file such as a PHP script in a web‑accessible directory. This results in the ability to execute arbitrary code in the context of the web application, potentially compromising the entire server. The weakness is identified as CWE‑434 (Unrestricted Upload of File With Dangerous Type).

Affecting the SOPlanning application from the vendor SOPlanning, version 1.55 and earlier. No additional vendor or product detail is provided.

The CVSS score of 6.4 reflects moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires legitimate authentication to the backup functionality, making the threat vector authenticated. The combination with an existing Path Traversal flaw increases the risk by enabling remote file execution in a web‑accessible location.