CVE-2026-110468
CriticalCVSS 10.0Summary
WidzialniCMS is vulnerable to unrestricted file upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any location on the server, leading to remote code execution.
Risk Assessment
Remote code execution allows an attacker to take control of the web server and access application data. The vulnerability is especially dangerous because it requires no authentication.
Recommendation
Update WidzialniCMS to version 2.5 or later. Until patched, consider restricting access to the /panel/controllers/save_photo.php endpoint.
Other vulnerabilities in WidzialniCMS
See all- CVE-2026-112205Medium
WidzialniCMS is vulnerable to brute force protection bypass in the login functionality. The cookie-based lockout can be bypassed by omitting the login_count and login_timeout cookies, allowing an unauthenticated attacker unlimited login attempts. The issue is fixed in version 2.5.
- CVE-2026-112204Medium
WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint. An attacker can prepare a URL that, when opened, results in arbitrary JavaScript execution in the victim's browser, allowing e.g. session cookie theft. This issue has been fixed in version 2.5.
- CVE-2026-110469Critical
WidzialniCMS is vulnerable to unrestricted file upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any location on the server, leading to remote code execution.
Original NVD description (English source)
WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution. This issue has been fixed in version 2.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS