CVE-2026-110468

UNKNOWN 0.0

Remote Code Execution via Unrestricted File Upload in WidzialniCMS

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution. This issue has been fixed in version 2.5.

CWE	CWE-434
Vendor	fundacja widzialni
Product	widzialnicms
Published	Nov 9, 2026
Last Updated	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for fundacja widzialni widzialnicms

Be the first to know when new unknown vulnerabilities affecting fundacja widzialni widzialnicms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Fundacja Widzialni / WidzialniCMS

0 < 2.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

cert.pl: https://cert.pl/posts/2026/11/CVE-2026-110468 widzialni.org: https://widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175

Credits

Kamil Szczurowski Robert Kruczek