WIDZIALNICMS · CVE-2026-110468 · Other
NO FIX YET · SEE WHAT TO DO
WidzialniCMS trusts a client-controlled permission parameter in its photo-save endpoint and does not validate the upload path. An unauthenticated attacker can upload arbitrary files to any location on the server, which leads to remote code execution.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running WidzialniCMS whose panel endpoint is reachable over the network. The flaw sits in an endpoint that accepts a client-controlled permission flag and an unvalidated path, so any internet-facing install before 2.5 is exposed without logging in. Sites that do not run this CMS can skip it.
Not affected if not-widzialnicms, patched-2.5
Who cares php, self-hosted, widzialnicms
2.5panel/controllers/save_photo.php in the web root and confirm whether it is reachable from the internet/panel/controllers/save_photo.php2.5WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.
This issue has been fixed in version 2.5.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.