WidzialniCMS unrestricted file upload allows remote code execution

Summary

Versions of WidzialniCMS before 2.5 let an unauthenticated attacker upload files to any location on the server, which can lead to remote code execution. The same versions also have a reflected XSS that can steal session cookies and a login lockout bypass.

What to do

Update WidzialniCMS to 2.5 or later.

Products and platforms

• WidzialniCMS

CVE IDs

• CVE-2026-110468 (opens in a new tab)
• CVE-2026-110469 (opens in a new tab)
• CVE-2026-112204 (opens in a new tab)
• CVE-2026-112205 (opens in a new tab)

Sources

• Write-up: cert.pl (opens in a new tab)
• CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)

Times

First published 2026-11-09 12:46 UTC

First seen 2026-11-09 12:54 UTC