EDITO CMS · CVE-2026-59079 · Other
NO FIX YET · SEE WHAT TO DO
Edito CMS limits file types in its normal upload screen, but the avatar upload path does not apply that limit. An attacker who can use avatar upload can store files of any type and extension on the server.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Not affected if no-avatar-upload-exposed, upgraded-to-5.10.2607
Who cares cms, edito-cms, file-upload
5.10.2607 or the 5.8 hotfix..php or .html on a test copy.5.10.2607 (fixed release)Edito CMS restricts the ability to upload files via the UI to specific file types. However, an avatar upload functionality allows an attacker to upload files of any type and extension without restriction. This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.