CRITICAL 10.0 NVD
CVE-2026-110468
WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter
WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.
This issue has been fixed in version 2.5.
References
- https://cert.pl/posts/2026/11/CVE-2026-110468
- https://widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175
This critical severity vulnerability with a CVSS score of 10.0 was published on 2026-11-09 via NVD.
Risk Timeline
CVE Disclosed2026-11-09 · 0 days ago
Remediation Resources
Official Advisory
cert.pl/posts/2026/11/CVE-2026-110468Analysis & PoC
widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175
vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.