{"id":"CVE-2026-110469","kind":"vulnerability","aliases":["CVE-2026-110469"],"related":[],"title":"WidzialniCMS: unauthenticated file upload lets attackers run code on server","description":"WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.\n\n\nThis issue has been fixed in version 2.5.","summary":"WidzialniCMS's /panel/upload.php endpoint trusts a client-controlled permission parameter and does not validate the uploadPath parameter. An unauthenticated attacker can upload arbitrary files to any location on the server, which leads to remote code execution.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WidzialniCMS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","php","self-hosted","widzialnicms"],"not_affected_if":["endpoint-blocked","version-2.5-or-later"],"how_to_check":"- Check whether the installed WidzialniCMS version is below `2.5`\n- Look for WidzialniCMS deployments that expose `/panel/upload.php` to the internet","fix":"- WidzialniCMS: move to `2.5`","status":"open","published_at":"2026-11-09T13:17:03+00:00","first_seen_at":"2026-11-09T13:26:49+00:00","triaged_at":"2026-11-09T13:27:26+00:00","updated_at":"2026-11-09T13:27:26+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-09T13:27:26Z","model":"claude-haiku-5-5","output":{"fix":"- WidzialniCMS: move to `2.5`","reach":"internet","title":"WidzialniCMS: unauthenticated file upload lets attackers run code on server","impact":"high","summary":"WidzialniCMS's /panel/upload.php endpoint trusts a client-controlled permission parameter and does not validate the uploadPath parameter. An unauthenticated attacker can upload arbitrary files to any location on the server, which leads to remote code execution.","audience":"businesses","category":"other","nicknames":[],"who_cares":["widzialnicms","php","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker uploads files anywhere on server and runs code","analyst_note":"Confirm affected version range and whether the default install exposes /panel/upload.php; source is only NVD.","how_to_check":"- Check whether the installed WidzialniCMS version is below `2.5`\n- Look for WidzialniCMS deployments that expose `/panel/upload.php` to the internet","plain_action":"","product_name":"WidzialniCMS","needs_analyst":true,"not_affected_if":["version-2.5-or-later","endpoint-blocked"],"who_is_affected":"Any site running WidzialniCMS before version 2.5 that exposes the /panel/upload.php endpoint is exposed, and the attack needs no account. Sites on version 2.5 or later, or with that endpoint blocked from outside access, are not affected by this description. Whether the endpoint is reachable from the internet in a given deployment is unknown.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000755,"input_tokens":4583,"output_tokens":593,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-110469':13A,16A '-2026':12A,15A '/panel/upload.php':26B,70C '2.5':113C 'arbitrari':47B,93C 'attack':6A,44B,90C 'check':79C 'client':31B,76C 'client-control':30B,75C 'code':8A,59B,104C 'control':32B,77C 'cve':11A,14A 'due':72C 'endpoint':27B,71C 'execut':60B,105C 'file':3A,48B,66C,94C 'fix':110C 'host':22B 'insuffici':82C 'issu':107C 'lead':56B,101C 'let':5A 'locat':51B,97C 'paramet':34B,41B,80C,87C 'permiss':33B,78C 'php':19B 'remot':58B,103C 'run':7A 'self':21B 'self-host':20B 'server':10A,54B,100C 'trust':28B 'unauthent':2A,43B,89C 'unrestrict':65C 'upload':4A,46B,67C,92C 'uploadpath':40B,86C 'valid':38B,83C 'version':112C 'vulner':63C 'widzialnicm':1A,23B,24B,61C 'widzialnicms':17A","nicknames":[],"mitigations":[],"who_affected":"Any site running WidzialniCMS before version 2.5 that exposes the /panel/upload.php endpoint is exposed, and the attack needs no account. Sites on version 2.5 or later, or with that endpoint blocked from outside access, are not affected by this description. Whether the endpoint is reachable from the internet in a given deployment is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["widzialnicms"],"ptokens":["widzialnicms"],"labels":["critical","other","php","selfhosted","vendor","widzialnicms"],"campaign_type":null,"search_a":"'-110469':13A,16A '-2026':12A,15A 'attack':6A 'code':8A 'cve':11A,14A 'file':3A 'let':5A 'run':7A 'server':10A 'unauthent':2A 'upload':4A 'widzialnicm':1A 'widzialnicms':17A","search_b":"'/panel/upload.php':26B 'arbitrari':47B 'attack':44B 'client':31B 'client-control':30B 'code':59B 'control':32B 'endpoint':27B 'execut':60B 'file':48B 'host':22B 'lead':56B 'locat':51B 'paramet':34B,41B 'permiss':33B 'php':19B 'remot':58B 'self':21B 'self-host':20B 'server':54B 'trust':28B 'unauthent':43B 'upload':46B 'uploadpath':40B 'valid':38B 'widzialnicm':23B,24B","search_c":"'/panel/upload.php':70C '2.5':113C 'arbitrari':93C 'attack':90C 'check':79C 'client':76C 'client-control':75C 'code':104C 'control':77C 'due':72C 'endpoint':71C 'execut':105C 'file':66C,94C 'fix':110C 'insuffici':82C 'issu':107C 'lead':101C 'locat':97C 'paramet':80C,87C 'permiss':78C 'remot':103C 'server':100C 'unauthent':89C 'unrestrict':65C 'upload':67C,92C 'uploadpath':86C 'valid':83C 'version':112C 'vulner':63C 'widzialnicm':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T13:17:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110469","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110469","severity":null,"published_at":"2026-11-09T13:17:03+00:00","modified_at":"2026-11-09T13:17:03+00:00","first_seen_at":"2026-11-09T13:26:49+00:00","fetched_at":"2026-11-09T13:26:49+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}