{"affected":[{"defaultStatus":"unaffected","product":"WidzialniCMS","source":"CNA: CERT-PL","vendor":"Fundacja Widzialni","versions":[{"lessThan":"2.5","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-110469","cwes":["CWE-434"],"description":"WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.\n\n\nThis issue has been fixed in version 2.5.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":10,"severity":"critical","source":"CNA: CERT-PL","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","version":"4.0"}],"modifiedAt":1794228445746,"publishedAt":1794228445746,"references":[{"source":"CNA: CERT-PL","tags":["third-party-advisory"],"url":"https://cert.pl/posts/2026/11/CVE-2026-110468"},{"source":"CNA: CERT-PL","tags":["product"],"url":"https://widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175"}],"remediation":[],"revision":"fbba0e3f16ad516e366cb08e52d978ab08075d61361295e2cf2d14487c7425f6","sources":[{"modifiedAt":1794228445746,"name":"CNA: CERT-PL","retrievedAt":1794229699902,"url":"https://www.cve.org/CVERecord?id=CVE-2026-110469"}],"ssvc":null,"status":"published","title":"Remote Code Execution via Unrestricted File Upload in WidzialniCMS","updatedAt":1794229699902}