WIDZIALNICMS · CVE-2026-110469 · Other
NO FIX YET · SEE WHAT TO DO
WidzialniCMS's /panel/upload.php endpoint trusts a client-controlled permission parameter and does not validate the uploadPath parameter. An unauthenticated attacker can upload arbitrary files to any location on the server, which leads to remote code execution.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any site running WidzialniCMS before version 2.5 that exposes the /panel/upload.php endpoint is exposed, and the attack needs no account. Sites on version 2.5 or later, or with that endpoint blocked from outside access, are not affected by this description. Whether the endpoint is reachable from the internet in a given deployment is unknown.
Not affected if endpoint-blocked, version-2.5-or-later
Who cares php, self-hosted, widzialnicms
2.5/panel/upload.php to the internet2.5WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.
This issue has been fixed in version 2.5.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.