CVE-2026-59079

UNKNOWN 0.0

Unrestricted File Upload in Edito CMS

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Edito CMS restricts the ability to upload files via the UI to specific file types. However, an avatar upload functionality allows an attacker to upload files of any type and extension without restriction. This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.

CWE	CWE-434
Vendor	edito
Product	edito cms
Published	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for edito edito cms

Be the first to know when new unknown vulnerabilities affecting edito edito cms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Edito / Edito CMS

0 < 5.10.2607

References

NVD ↗ CVE.org ↗ EPSS Data ↗

cert.pl: https://cert.pl/posts/2026/11/CVE-2026-59074 edito.pl: https://www.edito.pl/

Credits

Michał Majchrowicz (AFINE Team) Dawid Małecki (AFINE Team) Paweł Zdunek (AFINE Team) Franciszek Malek