CVE-2025-62731 Overview
CVE-2025-62731 is a stored cross-site scripting (XSS) vulnerability in SOPlanning, an open-source online planning tool. The flaw resides in the /feries endpoint, which manages public holidays. An authenticated attacker with access to the public holidays feature can inject arbitrary HTML and JavaScript. The injected payload executes when other users open pages that render the stored holiday data. By default, only administrators and users with special privileges can reach the endpoint. The issue was fixed in SOPlanning version 1.55. This vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.
Critical Impact
Stored JavaScript payloads execute in the browsers of legitimate users, enabling session hijacking, forced actions, and interface manipulation across multiple SOPlanning pages.
Affected Products
- SOPlanning versions prior to 1.55
- SOPlanning /feries (public holidays) endpoint
- Deployments where privileged users can author holiday entries
Discovery Timeline
- 2025-11-20 - CVE-2025-62731 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-62731
Vulnerability Analysis
SOPlanning fails to sanitize user-supplied input submitted through the /feries public holidays endpoint. The application stores the raw input and later renders it into HTML pages without contextual output encoding. When another user loads a page that references the stored holiday data, the browser parses attacker-controlled markup and executes any embedded JavaScript. Because holiday entries appear across multiple views in the planning interface, a single injected payload can affect many downstream pages and viewers. The vulnerability requires authenticated access, so the attack surface is limited to users granted administrative or elevated privileges to manage holidays. See the CERT Polska advisory for background on related SOPlanning issues.
Root Cause
The root cause is missing input sanitization and output encoding in the /feries handler. SOPlanning treats holiday name and description fields as trusted strings, storing them verbatim in the database. When these fields are rendered in HTML contexts, no escaping is applied, so attacker-supplied tags like <script> or event handler attributes execute in the victim's browser session.
Attack Vector
An attacker with a privileged SOPlanning account submits a crafted public holiday entry containing HTML or JavaScript through /feries. The payload is persisted in the application database. When any user with access to holiday-referencing pages loads them, the payload executes in their authenticated browser context. Because SOPlanning is a network-facing web application, the attacker only needs valid credentials and an authenticated browser session to deliver the payload.
No verified public exploit code is available for CVE-2025-62731. See the CERT Polska advisory and the SOPlanning project site for further technical detail.
Detection Methods for CVE-2025-62731
Indicators of Compromise
- Public holiday entries in SOPlanning containing HTML tags such as <script>, <img onerror=>, or <svg onload=>.
- Unexpected outbound requests from user browsers to attacker-controlled domains after loading planning pages.
- Session cookie theft or unauthorized configuration changes originating from privileged SOPlanning accounts.
- Audit log entries showing holiday creations or edits from unusual accounts or at unusual times.
Detection Strategies
- Query the SOPlanning database for holiday records where name or description fields contain angle brackets, javascript:, or common event handler attributes.
- Enable and review web server access logs for POST requests to /feries containing encoded script payloads.
- Deploy a Content Security Policy (CSP) report-only header to surface inline script execution triggered by stored payloads.
Monitoring Recommendations
- Monitor privileged SOPlanning user activity, especially additions or modifications to holiday data.
- Alert on browser telemetry showing unexpected script execution within SOPlanning page origins.
- Track outbound network traffic from workstations after users interact with SOPlanning to detect credential exfiltration attempts.
How to Mitigate CVE-2025-62731
Immediate Actions Required
- Upgrade SOPlanning to version 1.55 or later, which contains the vendor fix for the /feries stored XSS.
- Audit existing public holiday entries for HTML or JavaScript content and remove or sanitize any suspicious records.
- Review the list of accounts granted privileges to manage holidays and revoke unnecessary access.
- Rotate session cookies and credentials for administrators who may have viewed compromised pages.
Patch Information
The vendor fixed CVE-2025-62731 in SOPlanning version 1.55. Administrators should download the current release from the SOPlanning project site and apply it following the project's upgrade instructions. Verify the deployed version after upgrade and confirm that stored holiday entries render as literal text rather than executing markup.
Workarounds
- Restrict access to the /feries endpoint at the reverse proxy or web server layer to a minimal set of trusted administrators.
- Deploy a strict Content Security Policy that disallows inline scripts and untrusted script sources to blunt payload execution.
- Place a web application firewall rule in front of SOPlanning to block requests containing script tags or common XSS patterns targeting /feries.
- Manually sanitize existing holiday entries by re-saving them with plain-text values until the upgrade is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
