CVE-2026-110469 Remote Code Execution via Unrestricted File Upload in WidzialniCMS

CriticalCVSS 10.0

Published: 2026-11-09 14:47
Updated: 2026-11-09 19:34
Exploit status: No public exploit known

Description

WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.

This issue has been fixed in version 2.5.

Affected products

Product	Affected versions	Fixed in
Fundacja Widzialni WidzialniCMS	< 2.5	2.5

References

cert.pl third-party-advisory
widzialni.org product

CVSS v4.0

10.0 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: High
Subsequent System Confidentiality: High
Subsequent System Integrity: High
Subsequent System Availability: High

Weakness & likelihood

EPSS (exploitation probability, 30 days): Not available
CWE: CWE-434 Unrestricted Upload of File with Dangerous Type

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.