CVE-2026-110468— Remote Code Execution via Unrestricted File Upload in WidzialniCMS

Quick assessment

Affected

Fundacja Widzialni WidzialniCMS

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WidzialniCMS 在端点存在不受限制的文件上传漏洞。由于权限检查参数由客户端控制，且对参数的验证不足，未认证的攻击者可以将任意文件上传到服务器上的任意位置，从而导致远程代码执行（RCE）。该问题已在 2.5 版本中修复。

CVSS 10.0 · Critical Updated Nov 09, 2026

Possible ATT&CK Techniques 3 AI

T1059 · Command and Scripting Interpreter T1055 · Process Injection T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Remote Code Execution via Unrestricted File Upload in WidzialniCMS

Source: CVE Program / CVE List V5

Vulnerability Description

WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution. This issue has been fixed in version 2.5.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Source: CVE Program / CVE List V5

Vulnerability Type

危险类型文件的不加限制上传

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Fundacja Widzialni	WidzialniCMS	0 ~ 2.5	-

II. Public POCs for CVE-2026-110468

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-110468

请登录查看更多情报信息。

Other References for CVE-2026-110468 (2)

https://widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175 product
https://cert.pl/posts/2026/11/CVE-2026-110468 third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-110468

Same Patch Batch · Fundacja Widzialni · 2026-11-09 · 4 CVEs total

CVE-2026-110469	10.0 CRITICAL	Remote Code Execution via Unrestricted File Upload in WidzialniCMS
CVE-2026-112205	6.9 MEDIUM	Bruteforce Protection Bypass in WidzialniCMS
CVE-2026-112204	5.1 MEDIUM	Reflected XSS in WidzialniCMS

IV. Related Vulnerabilities

Same product: WidzialniCMS

Same vendor: Fundacja Widzialni

Same weakness: CWE-434