---
id: "CVE-2026-110469"
page: "https://infrastack.ai/live/CVE-2026-110469"
kind: "vulnerability"
aliases: ["CVE-2026-110469"]
title: "WidzialniCMS: unauthenticated file upload lets attackers run code on server"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "WidzialniCMS", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["other", "php", "self-hosted", "widzialnicms"]
not_affected_if: ["endpoint-blocked", "version-2.5-or-later"]
published_at: "2026-11-09T13:17:03+00:00"
first_seen_at: "2026-11-09T13:26:49+00:00"
updated_at: "2026-11-09T13:27:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110469", "first_seen_at": "2026-11-09T13:26:49+00:00"}]
exploit_sources: []
---

# WidzialniCMS: unauthenticated file upload lets attackers run code on server

Link for people: https://infrastack.ai/live/CVE-2026-110469 (this .md is for agents)

WidzialniCMS's /panel/upload.php endpoint trusts a client-controlled permission parameter and does not validate the uploadPath parameter. An unauthenticated attacker can upload arbitrary files to any location on the server, which leads to remote code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WidzialniCMS affected range not listed fixed no fixed version listed

## How to check

- Check whether the installed WidzialniCMS version is below `2.5`
- Look for WidzialniCMS deployments that expose `/panel/upload.php` to the internet

## Fix

- WidzialniCMS: move to `2.5`

## Timeline

- 2026-11-09T13:26:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110469

## From the sources

WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.


This issue has been fixed in version 2.5.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_