Description
WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.


This issue has been fixed in version 2.5.
Published: 2026-11-09
Score: 10 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 09 Nov 2026 13:00:00 +0000

Type Values Removed Values Added
Description WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution. This issue has been fixed in version 2.5.
Title Remote Code Execution via Unrestricted File Upload in WidzialniCMS
First Time appeared Fundacja Widzialni
Fundacja Widzialni widzialnicms
Weaknesses CWE-434
CPEs cpe:2.3:a:fundacja_widzialni:widzialnicms:*:*:*:*:*:*:*:*
Vendors & Products Fundacja Widzialni
Fundacja Widzialni widzialnicms
References
Metrics cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

Fundacja Widzialni Widzialnicms
cve-icon MITRE

Status: PUBLISHED

Assigner: CERT-PL

Published:

Updated: 2026-11-09T12:47:25.746Z

Reserved: 2026-10-14T07:27:21.675Z

Link: CVE-2026-110469

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-09T13:17:03.910

Modified: 2026-11-09T13:17:03.910

Link: CVE-2026-110469

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-434

    Unrestricted Upload of File with Dangerous Type