CVE-2026-59079

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59079", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2026-07-02T08:57:58.309Z", "datePublished": "2026-11-13T07:28:26.032Z", "dateUpdated": "2026-11-13T07:28:26.032Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-11-13T07:28:26.032Z"}, "title": "Unrestricted File Upload in Edito CMS", "datePublic": "2026-11-12T09:59:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "type": "CWE"}]}], "affected": [{"vendor": "Edito", "product": "Edito CMS", "versions": [{"status": "affected", "version": "0", "lessThan": "5.10.2607", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Edito CMS restricts the ability to upload files via the UI to specific file types. However, an avatar upload functionality\u00a0allows an attacker to upload files of any type and extension without restriction.\nThis issue was fixed in version 5.10.2607.\u00a0 Hotfixes for older versions (5.8)\u00a0have also been released.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Edito CMS restricts the ability to upload files via the UI to specific file types. However, an a<span>vatar upload functionality&nbsp;</span><span>allows an attacker to upload files of any type and extension without restriction.</span><div><br>This issue was fixed in version 5.10.2607.&nbsp; Hotfixes for older versions (5.8)&nbsp;have also been released.</div>"}]}], "references": [{"url": "https://cert.pl/posts/2026/11/CVE-2026-59074", "tags": ["third-party-advisory"]}, {"url": "https://www.edito.pl/", "tags": ["product"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Micha\u0142 Majchrowicz (AFINE Team)", "type": "finder"}, {"lang": "en", "value": "Dawid Ma\u0142ecki (AFINE Team)", "type": "finder"}, {"lang": "en", "value": "\u200bPawe\u0142 Zdunek (AFINE Team)", "type": "finder"}, {"lang": "en", "value": "Franciszek Malek", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.3"}}}}

{}

{}

{}

{}