WidzialniCMS flaws allow unauthenticated RCE
Four vulnerabilities in WidzialniCMS before 2.5 allow unauthenticated file upload RCE, reflected XSS, and brute-force lockout bypass; patch to 2.5.
Sourcecert.pl — open the original
What to check
- Applies to
- The 4 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of four vulnerabilities affecting WidzialniCMS versions prior to 2.5, developed by Fundacja Widzialni. The two most severe issues, CVE-2026-110468 and CVE-2026-110469, are unrestricted file upload flaws in the /panel/controllers/save_photo.php and /panel/upload.php endpoints respectively. Both stem from client-controlled permission check parameters and insufficient validation of path parameters (currentpath and uploadPath), allowing an unauthenticated attacker to upload arbitrary files to any server location, resulting in remote code execution.
Additionally, CVE-2026-112204 is a reflected XSS vulnerability in /index.php that allows an attacker to craft a malicious URL leading to arbitrary JavaScript execution in a victim's browser, enabling session cookie theft. CVE-2026-112205 describes a bruteforce protection bypass in the login functionality, where the cookie-based lockout mechanism can be circumvented by simply omitting the login_count and login_timeout cookies, permitting unlimited login attempts by an unauthenticated attacker.
All four issues were fixed in WidzialniCMS version 2.5. No evidence of in-the-wild exploitation is mentioned in the advisory. Defenders running WidzialniCMS should upgrade to version 2.5 immediately, given the unauthenticated RCE potential, and review web server logs for unusual file uploads to panel upload endpoints or anomalous login attempt patterns as part of a retrospective check.
Mentioned in this report
Detection guidance
WidzialniCMS Unauthenticated File Upload Endpoint POST Success
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Successful POST to the WidzialniCMS save_photo.php or upload.php panel endpoints (CVE-2026-110468/110469), which allow arbitrary file upload and RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WidzialniCMS Unauthenticated File Upload Endpoint POST Success
description: Detects successful POST requests to the WidzialniCMS /panel/controllers/save_photo.php
and /panel/upload.php endpoints, abused by CVE-2026-110468 and CVE-2026-110469 for
unrestricted file upload leading to RCE. Review whether the source is an authenticated
administrator.
tags:
- attack.initial-access
- attack.t1190
- attack.persistence
- attack.t1505.003
logsource:
category: webserver
detection:
selection:
cs-method: POST
cs-uri-stem|endswith:
- /panel/controllers/save_photo.php
- /panel/upload.php
sc-status:
- 200
- 201
- 302
condition: selection
falsepositives:
- Legitimate authenticated administrators uploading photos or files through the WidzialniCMS
panel
level: medium
id: fbe47cc7-07f9-5268-be20-ab3a9749f54d
status: experimental
author: Vorant
references:
- https://cert.pl/en/posts/2026/11/CVE-2026-110468
WidzialniCMS Upload Endpoint Path Traversal in Path Parameters
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Requests to WidzialniCMS upload endpoints where currentpath or uploadPath contain directory traversal sequences to place files in arbitrary locations. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WidzialniCMS Upload Endpoint Path Traversal in Path Parameters
description: Detects requests to WidzialniCMS save_photo.php or upload.php carrying
currentpath or uploadPath parameters with directory traversal sequences, the insufficient
path validation abused in CVE-2026-110468 and CVE-2026-110469 to write files to
arbitrary server locations.
tags:
- attack.initial-access
- attack.t1190
- attack.persistence
- attack.t1505.003
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-stem|endswith:
- /panel/controllers/save_photo.php
- /panel/upload.php
selection_param:
cs-uri-query|contains:
- currentpath=
- uploadpath=
selection_traversal:
cs-uri-query|contains:
- ../
- ..\
- ..%2f
- ..%5c
- '%2e%2e'
condition: selection_endpoint and selection_param and selection_traversal
falsepositives:
- Custom integrations or scripts that legitimately use relative paths with the upload
endpoint
level: high
id: a083aef4-165c-547c-84bb-dc17832632e3
status: experimental
author: Vorant
references:
- https://cert.pl/en/posts/2026/11/CVE-2026-110468
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/11/CVE-2026-110468
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs