CVE-2026-110469criticalCWE-434

CVE-2026-110469: critical vulnerability in Fundacja Widzialni WidzialniCMS

Remote Code Execution via Unrestricted File Upload in WidzialniCMS

Published

Follow this CVE+ Monitor WidzialniCMS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

25Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 10
WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution. This issue has been fixed in version 2.5.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
Fundacja Widzialni · WidzialniCMS
Related CVEs — Fundacja Widzialni WidzialniCMS

In the same product, most dangerous first.

CVE-2026-112205MEDIUMBruteforce Protection Bypass in WidzialniCMSEPSS —CVE-2026-112204MEDIUMReflected XSS in WidzialniCMSEPSS —CVE-2026-110468CRITICALRemote Code Execution via Unrestricted File Upload in WidzialniCMSEPSS —