{"id":"CVE-2026-59079","kind":"vulnerability","aliases":["CVE-2026-59079"],"related":[],"title":"Edito CMS: avatar upload accepts any file type and extension","description":"Edito CMS restricts the ability to upload files via the UI to specific file types. However, an avatar upload functionality allows an attacker to upload files of any type and extension without restriction.\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.","summary":"Edito CMS limits file types in its normal upload screen, but the avatar upload path does not apply that limit. An attacker who can use avatar upload can store files of any type and extension on the server.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Edito CMS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cms","edito-cms","file-upload","other"],"not_affected_if":["no-avatar-upload-exposed","upgraded-to-5.10.2607"],"how_to_check":"- Check the installed Edito CMS version and compare it with the fixed release `5.10.2607` or the 5.8 hotfix.\n- Look at whether the avatar upload accepts non-image files such as `.php` or `.html` on a test copy.","fix":"- Edito CMS `5.10.2607` (fixed release)\n- Edito CMS 5.8 hotfix (hotfixes for older versions have been released; exact build not stated in sources)","status":"open","published_at":"2026-11-13T08:17:18+00:00","first_seen_at":"2026-11-13T08:44:25+00:00","triaged_at":"2026-11-13T08:45:21+00:00","updated_at":"2026-11-13T08:45:21+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T08:45:21Z","model":"claude-haiku-5-5","output":{"fix":"- Edito CMS `5.10.2607` (fixed release)\n- Edito CMS 5.8 hotfix (hotfixes for older versions have been released; exact build not stated in sources)","reach":"unknown","title":"Edito CMS: avatar upload accepts any file type and extension","impact":"high","summary":"Edito CMS limits file types in its normal upload screen, but the avatar upload path does not apply that limit. An attacker who can use avatar upload can store files of any type and extension on the server.","audience":"businesses","category":"other","nicknames":[],"who_cares":["edito-cms","cms","file-upload"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker uploads executable files to the server","analyst_note":"Confirm which account role can use avatar upload and whether uploaded files are served from a web-accessible path; source is NVD only.","how_to_check":"- Check the installed Edito CMS version and compare it with the fixed release `5.10.2607` or the 5.8 hotfix.\n- Look at whether the avatar upload accepts non-image files such as `.php` or `.html` on a test copy.","plain_action":"","product_name":"Edito CMS","needs_analyst":true,"not_affected_if":["upgraded-to-5.10.2607","no-avatar-upload-exposed"],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000718,"input_tokens":4537,"output_tokens":528,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-59079':13A,16A '5.10.2607':103C '5.8':108C 'abil':68C 'accept':5A 'allow':84C 'also':110C 'appli':43B 'attack':47B,86C 'avatar':3A,38B,51B,81C 'cms':2A,18A,19B,22B,27B,65C 'cve':11A,14A 'edito':1A,17A,21B,26B,64C 'edito-cm':20B 'extens':10A,60B,94C 'file':7A,24B,29B,55B,71C,77C,89C 'file-upload':23B 'fix':100C 'function':83C 'hotfix':104C 'howev':79C 'issu':98C 'limit':28B,45B 'normal':33B 'older':106C 'path':40B 'releas':112C 'restrict':66C,96C 'screen':35B 'server':63B 'specif':76C 'store':54B 'type':8A,30B,58B,78C,92C 'ui':74C 'upload':4A,25B,34B,39B,52B,70C,82C,88C 'use':50B 'version':102C,107C 'via':72C 'without':95C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["cms","editocms"],"ptokens":["cms","edito"],"labels":["cms","editocms","fileupload","high","other","vendor"],"campaign_type":null,"search_a":"'-2026':12A,15A '-59079':13A,16A 'accept':5A 'avatar':3A 'cms':2A,18A 'cve':11A,14A 'edito':1A,17A 'extens':10A 'file':7A 'type':8A 'upload':4A","search_b":"'appli':43B 'attack':47B 'avatar':38B,51B 'cms':19B,22B,27B 'edito':21B,26B 'edito-cm':20B 'extens':60B 'file':24B,29B,55B 'file-upload':23B 'limit':28B,45B 'normal':33B 'path':40B 'screen':35B 'server':63B 'store':54B 'type':30B,58B 'upload':25B,34B,39B,52B 'use':50B","search_c":"'5.10.2607':103C '5.8':108C 'abil':68C 'allow':84C 'also':110C 'attack':86C 'avatar':81C 'cms':65C 'edito':64C 'extens':94C 'file':71C,77C,89C 'fix':100C 'function':83C 'hotfix':104C 'howev':79C 'issu':98C 'older':106C 'releas':112C 'restrict':66C,96C 'specif':76C 'type':78C,92C 'ui':74C 'upload':70C,82C,88C 'version':102C,107C 'via':72C 'without':95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T08:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59079","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59079","severity":null,"published_at":"2026-11-13T08:17:18+00:00","modified_at":"2026-11-13T08:17:18+00:00","first_seen_at":"2026-11-13T08:44:25+00:00","fetched_at":"2026-11-13T08:44:25+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}