Arbitrary file upload in Fundacja Widzialni Widzialnicms
CVE-2026-110468
WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution. This issue has been fixed in version 2.5.
Vulnerability class: Unrestricted File Upload
Published · last modified .
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cert.pl/posts/2026/11/CVE-2026-110468 (third-party-advisory)
- widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175 (product)
Frequently asked questions
- What is CVE-2026-110468?
- CVE-2026-110468 is a vulnerability in Fundacja Widzialni Widzialnicms, classified under Unrestricted Upload of File with Dangerous Type. Published 2026-11-09.
- Is CVE-2026-110468 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.