WidzialniCMS allows an attacker to upload arbitrary files due to missing validation. The upload endpoint checks a client‑supplied permission flag and an insufficiently validated path parameter. An unauthenticated attacker can therefore place executable scripts on the server and trigger their execution, compromising confidentiality, integrity, and availability.

The flaw exists in the WidzialniCMS platform supplied by Fundacja Widzialni. All versions prior to the 2.5 release are affected. It specifically targets the /panel/controllers/save_photo.php endpoint. The vulnerability has been assigned CWE-434, indicating an unrestricted file upload weakness.

The CVSS score of 10 signals a critical severity. The EPSS score is not reported, so the current prediction of exploitation probability is unknown, but the lack of an exploitable demo implies potential for real‑world attacks. The vulnerability is not yet catalogued in CISA KEV, yet its remote nature and lack of authentication requirement mean it can be leveraged by attackers with minimal access. The attack vector is inferred from the description: an unauthenticated client can send a crafted upload request from any network location.