Description
WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.
This issue has been fixed in version 2.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fundacja Widzialni | WidzialniCMS | < 2.5 | 2.5 |
References
- https://cert.pl/posts/2026/11/CVE-2026-110468 third-party-advisory
- https://widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175 product