---
id: "CVE-2026-59079"
page: "https://infrastack.ai/live/CVE-2026-59079"
kind: "vulnerability"
aliases: ["CVE-2026-59079"]
title: "Edito CMS: avatar upload accepts any file type and extension"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Edito CMS", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cms", "edito-cms", "file-upload", "other"]
not_affected_if: ["no-avatar-upload-exposed", "upgraded-to-5.10.2607"]
published_at: "2026-11-13T08:17:18+00:00"
first_seen_at: "2026-11-13T08:44:25+00:00"
updated_at: "2026-11-13T08:45:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59079", "first_seen_at": "2026-11-13T08:44:25+00:00"}]
exploit_sources: []
---

# Edito CMS: avatar upload accepts any file type and extension

Link for people: https://infrastack.ai/live/CVE-2026-59079 (this .md is for agents)

Edito CMS limits file types in its normal upload screen, but the avatar upload path does not apply that limit. An attacker who can use avatar upload can store files of any type and extension on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Edito CMS affected range not listed fixed no fixed version listed

## How to check

- Check the installed Edito CMS version and compare it with the fixed release `5.10.2607` or the 5.8 hotfix.
- Look at whether the avatar upload accepts non-image files such as `.php` or `.html` on a test copy.

## Fix

- Edito CMS `5.10.2607` (fixed release)
- Edito CMS 5.8 hotfix (hotfixes for older versions have been released; exact build not stated in sources)

## Timeline

- 2026-11-13T08:44:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-59079

## From the sources

Edito CMS restricts the ability to upload files via the UI to specific file types. However, an avatar upload functionality allows an attacker to upload files of any type and extension without restriction.
This issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_