Paper/Archive/CVE-2026-110469

CVE-2026-110469

Fundacja Widzialni WidzialniCMS — Remote Code Execution via Unrestricted File Upload in WidzialniCMS

CVSS 10.0 (CNA)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 No EPSS score.000 × 200.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution. This issue has been fixed in version 2.5.

Affected

ProductAffectedFixed inSource

WidzialniCMS< 2.52.5CNA

Scores by source

CERT-PL (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeupcert.pl/posts/2026/11/CVE-2026-110468 refwidzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175