Critical 10.0

WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to...

CVE-2026-110469 First seen on SecPulse Nov 9, 21:47

Affected packages

Ecosystem	Package	Affected → Fixed	Fixed
Fundacja Widzialni	Fundacja WidzialniWidzialniCMS	< 2.5→ 2.5	2.5

Original description The description as published by the source.

WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.

This issue has been fixed in version 2.5.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v4: Critical 10.0; CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Published: Nov 9, 2026
First seen on SecPulse: Nov 9, 21:47
GHSA: GHSA-f99m-gc4m-qgfj
CWE: CWE-434

NVD GitHub Advisory

Tags(click for explanation)

Programming Languages

PHP

Attack Types

Remote Code Execution

CWE

CWE-434

All

Fundacja Widzialni Widzialnicms

Detection sources

NIST National Vulnerability DatabaseNov 10, 03:17
GitHub Security Advisories (Global)Nov 10, 00:32
CVE.org (CVE Program・cvelistV5)Nov 10, 02:34