---
id: "CVE-2026-110468"
page: "https://infrastack.ai/live/CVE-2026-110468"
kind: "vulnerability"
aliases: ["CVE-2026-110468"]
title: "WidzialniCMS: unauthenticated file upload lets attackers run code on the server"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "WidzialniCMS", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["other", "php", "self-hosted", "widzialnicms"]
not_affected_if: ["not-widzialnicms", "patched-2.5"]
published_at: "2026-11-09T13:17:03+00:00"
first_seen_at: "2026-11-09T13:26:49+00:00"
updated_at: "2026-11-09T13:27:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110468", "first_seen_at": "2026-11-09T13:26:49+00:00"}]
exploit_sources: []
---

# WidzialniCMS: unauthenticated file upload lets attackers run code on the server

Link for people: https://infrastack.ai/live/CVE-2026-110468 (this .md is for agents)

WidzialniCMS trusts a client-controlled permission parameter in its photo-save endpoint and does not validate the upload path. An unauthenticated attacker can upload arbitrary files to any location on the server, which leads to remote code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WidzialniCMS affected range not listed fixed no fixed version listed

## How to check

- Check whether the installed WidzialniCMS version is below `2.5`
- Look for the file `panel/controllers/save_photo.php` in the web root and confirm whether it is reachable from the internet
- Review web server logs for POST requests to `/panel/controllers/save_photo.php`

## Fix

- WidzialniCMS: upgrade to `2.5`

## Timeline

- 2026-11-09T13:26:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110468

## From the sources

WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.


This issue has been fixed in version 2.5.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_