{"id":"CVE-2026-110468","kind":"vulnerability","aliases":["CVE-2026-110468"],"related":[],"title":"WidzialniCMS: unauthenticated file upload lets attackers run code on the server","description":"WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.\n\n\nThis issue has been fixed in version 2.5.","summary":"WidzialniCMS trusts a client-controlled permission parameter in its photo-save endpoint and does not validate the upload path. An unauthenticated attacker can upload arbitrary files to any location on the server, which leads to remote code execution.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WidzialniCMS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","php","self-hosted","widzialnicms"],"not_affected_if":["not-widzialnicms","patched-2.5"],"how_to_check":"- Check whether the installed WidzialniCMS version is below `2.5`\n- Look for the file `panel/controllers/save_photo.php` in the web root and confirm whether it is reachable from the internet\n- Review web server logs for POST requests to `/panel/controllers/save_photo.php`","fix":"- WidzialniCMS: upgrade to `2.5`","status":"open","published_at":"2026-11-09T13:17:03+00:00","first_seen_at":"2026-11-09T13:26:49+00:00","triaged_at":"2026-11-09T13:27:25+00:00","updated_at":"2026-11-09T13:27:25+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-09T13:27:25Z","model":"claude-haiku-5-5","output":{"fix":"- WidzialniCMS: upgrade to `2.5`","reach":"internet","title":"WidzialniCMS: unauthenticated file upload lets attackers run code on the server","impact":"high","summary":"WidzialniCMS trusts a client-controlled permission parameter in its photo-save endpoint and does not validate the upload path. An unauthenticated attacker can upload arbitrary files to any location on the server, which leads to remote code execution.","audience":"businesses","category":"other","nicknames":[],"who_cares":["widzialnicms","php","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated attacker runs code on the server","analyst_note":"Confirm the affected version range below 2.5 and whether the panel path is exposed by default at https://nvd.nist.gov/vuln/detail/CVE-2026-110468.","how_to_check":"- Check whether the installed WidzialniCMS version is below `2.5`\n- Look for the file `panel/controllers/save_photo.php` in the web root and confirm whether it is reachable from the internet\n- Review web server logs for POST requests to `/panel/controllers/save_photo.php`","plain_action":"","product_name":"WidzialniCMS","needs_analyst":true,"not_affected_if":["not-widzialnicms","patched-2.5"],"who_is_affected":"Sites running WidzialniCMS whose panel endpoint is reachable over the network. The flaw sits in an endpoint that accepts a client-controlled permission flag and an unvalidated path, so any internet-facing install before 2.5 is exposed without logging in. Sites that do not run this CMS can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000777,"input_tokens":4594,"output_tokens":636,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-110468':14A,17A '-2026':13A,16A '/panel/controllers/save_photo.php':74C '2.5':117C 'arbitrari':51B,97C 'attack':6A,48B,94C 'check':83C 'client':29B,80C 'client-control':28B,79C 'code':8A,63B,108C 'control':30B,81C 'currentpath':90C 'cve':12A,15A 'due':76C 'endpoint':38B,75C 'execut':64B,109C 'file':3A,52B,70C,98C 'fix':114C 'host':23B 'insuffici':86C 'issu':111C 'lead':60B,105C 'let':5A 'locat':55B,101C 'paramet':32B,84C,91C 'path':45B 'permiss':31B,82C 'photo':36B 'photo-sav':35B 'php':20B 'remot':62B,107C 'run':7A 'save':37B 'self':22B 'self-host':21B 'server':11A,58B,104C 'trust':26B 'unauthent':2A,47B,93C 'unrestrict':69C 'upload':4A,44B,50B,71C,96C 'valid':42B,87C 'version':116C 'vulner':67C 'widzialnicm':1A,24B,25B,65C 'widzialnicms':18A","nicknames":[],"mitigations":[],"who_affected":"Sites running WidzialniCMS whose panel endpoint is reachable over the network. The flaw sits in an endpoint that accepts a client-controlled permission flag and an unvalidated path, so any internet-facing install before 2.5 is exposed without logging in. Sites that do not run this CMS can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["widzialnicms"],"ptokens":["widzialnicms"],"labels":["critical","other","php","selfhosted","vendor","widzialnicms"],"campaign_type":null,"search_a":"'-110468':14A,17A '-2026':13A,16A 'attack':6A 'code':8A 'cve':12A,15A 'file':3A 'let':5A 'run':7A 'server':11A 'unauthent':2A 'upload':4A 'widzialnicm':1A 'widzialnicms':18A","search_b":"'arbitrari':51B 'attack':48B 'client':29B 'client-control':28B 'code':63B 'control':30B 'endpoint':38B 'execut':64B 'file':52B 'host':23B 'lead':60B 'locat':55B 'paramet':32B 'path':45B 'permiss':31B 'photo':36B 'photo-sav':35B 'php':20B 'remot':62B 'save':37B 'self':22B 'self-host':21B 'server':58B 'trust':26B 'unauthent':47B 'upload':44B,50B 'valid':42B 'widzialnicm':24B,25B","search_c":"'/panel/controllers/save_photo.php':74C '2.5':117C 'arbitrari':97C 'attack':94C 'check':83C 'client':80C 'client-control':79C 'code':108C 'control':81C 'currentpath':90C 'due':76C 'endpoint':75C 'execut':109C 'file':70C,98C 'fix':114C 'insuffici':86C 'issu':111C 'lead':105C 'locat':101C 'paramet':84C,91C 'permiss':82C 'remot':107C 'server':104C 'unauthent':93C 'unrestrict':69C 'upload':71C,96C 'valid':87C 'version':116C 'vulner':67C 'widzialnicm':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T13:17:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110468","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110468","severity":null,"published_at":"2026-11-09T13:17:03+00:00","modified_at":"2026-11-09T13:17:03+00:00","first_seen_at":"2026-11-09T13:26:49+00:00","fetched_at":"2026-11-09T13:26:49+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}