CVE-2026-110469

Fundacja Widzialni WidzialniCMS remote code execution via unrestricted file upload

critical · 10.0

Fix listed

Fundacja Widzialni WidzialniCMS

Published Nov 9, 2026, 12:47 UTC

Description

WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution. This issue has been fixed in version 2.5.

Reported fixed versions

2.5

Official CVE record View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.