CVE-2014-8676

Think of this like someone jiggling the doorknobs of rooms in your office building to see which ones exist — they can't get inside or take anything, but they learn information about your building's layout. In SOPlanning, an attacker can send a specially crafted web request to find out if certain files exist on your server, without being able to read or change those files.

This matters to you if you run SOPlanning (version 1.32 or earlier) for staff scheduling or resource planning. It affects you whether or not you require users to log in, since no authentication is needed to trigger the flaw — but it's only a real risk if your SOPlanning installation is reachable from the internet.

Public exploit code for this flaw already exists, and there has been sustained press attention around it, so it is a known and discussed issue, but there is no confirmed active exploitation campaign and the impact itself is limited to confirming file existence rather than full compromise. Treat this as something to address soon — restrict exposure and watch for a patch — rather than an emergency requiring immediate downtime.

1. Identify your SOPlanning version; versions 1.32 and earlier are affected.
2. Check whether the application is exposed to the public internet or only accessible internally/via VPN — exposure determines real-world risk.
3. No official fixed version has been published for this CVE; monitor the SOPlanning project's repository/changelog for a security release and upgrade promptly once available.
4. As an interim workaround, place the application behind authentication, a VPN, or an IP allowlist, and consider a web application firewall rule blocking '..' sequences in URL parameters targeting the vulnerable endpoint.
5. Review access logs for repeated requests containing '../' patterns in parameters, which may indicate probing attempts, given public exploits (2 known) exist.
6. This CVE is not in CISA's Known Exploited Vulnerabilities catalog, so there is no mandated remediation deadline, but prioritize given public exploit availability and sustained media attention.

CVSS 3.0 score 5.3 (Medium), vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N — network-exploitable, no privileges or user interaction required, limited confidentiality impact only (file existence disclosure), no integrity or availability impact. Weakness is CWE-22 (Path Traversal) in the file_get_contents function via unsanitized '..' sequences in a URL parameter. Two public exploits are known, indicating moderate exploit maturity, though no KEV listing or confirmed in-the-wild exploitation has been reported. EPSS places this in a high percentile among all scored CVEs with a falling trend, but per exploitation-priority rules this predictive score should not override the lack of confirmed active exploitation. No vendor patch is currently documented.