WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint.

PHP

WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.

Do this now

Check the vendor's advisory for a fix and restrict access to /panel/upload.php meanwhile.

Who should check: teams running PHP

First seen: 10 Nov 2026
Last update: 10 Nov 2026, 14:17 UTC
Versions per the CVE record from CERT-PL, not the vendor: 2.5
Identifiers: CVE-2026-110469
CVSS: 10.0
Source: news
On the menu as: PHP

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint.
Severity: critical. Patch status: fix status unknown.
Affected: PHP
Versions per the CVE record from CERT-PL, not the vendor: 2.5
Ids: CVE-2026-110469

WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.

## Steps
1. Search the repo, its CI and infra config for PHP. If present, report the version in use and whether it's affected.
2. Versions per the CVE record from CERT-PL, not the vendor: WidzialniCMS: 2.5. Don't treat them as a fix until the vendor says so.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| WidzialniCMS | per the CVE record from CERT-PL, not the vendor | 2.5 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-110469") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://cert.pl/posts/2026/11/CVE-2026-110468 https://nvd.nist.gov/vuln/detail/CVE-2026-110469
https://pwned.coffee/i/widzialnicms-is-vulnerable-to-unrestricted-file-upload-i-cve-2026-110469

Receipt

Exploitation: No known exploitation
By release line, per the CVE record from CERT-PL, not the vendor: Product Affected Version named Source
WidzialniCMS before 2.5 2.5 CVE record (CNA) per the CVE record from CERT-PL, not the vendor checked 13 Nov
Score: CVSS 10.0 (critical). CVSS 4.0 10 (CNA CERT-PL) for CVE-2026-110469
Last checked: 13 Nov 2026, 16:26 UTC

Product	Affected	Version named	Source
WidzialniCMS	before 2.5	2.5	CVE record (CNA) per the CVE record from CERT-PL, not the vendor checked 13 Nov

Sources: KEV – CVE record ✓ Vendor –

Sources

Follow on X

Totalone very hot coffee