# WidzialniCMS flaws allow unauthenticated RCE

Published: 2026-11-09 · Severity: routine
Canonical: https://vorant.io/reports/205ba048-966d-5a9d-96e6-c28cb80f2aaa/widzialnicms-flaws-allow-unauthenticated-rce
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> Four vulnerabilities in WidzialniCMS before 2.5 allow unauthenticated file upload RCE, reflected XSS, and brute-force lockout bypass; patch to 2.5.

Source: cert.pl — https://cert.pl/en/posts/2026/11/CVE-2026-110468

## What to check

- Applies to: The 4 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT Polska coordinated disclosure of four vulnerabilities affecting WidzialniCMS versions prior to 2.5, developed by Fundacja Widzialni. The two most severe issues, CVE-2026-110468 and CVE-2026-110469, are unrestricted file upload flaws in the /panel/controllers/save_photo.php and /panel/upload.php endpoints respectively. Both stem from client-controlled permission check parameters and insufficient validation of path parameters (currentpath and uploadPath), allowing an unauthenticated attacker to upload arbitrary files to any server location, resulting in remote code execution.

Additionally, CVE-2026-112204 is a reflected XSS vulnerability in /index.php that allows an attacker to craft a malicious URL leading to arbitrary JavaScript execution in a victim's browser, enabling session cookie theft. CVE-2026-112205 describes a bruteforce protection bypass in the login functionality, where the cookie-based lockout mechanism can be circumvented by simply omitting the login_count and login_timeout cookies, permitting unlimited login attempts by an unauthenticated attacker.

All four issues were fixed in WidzialniCMS version 2.5. No evidence of in-the-wild exploitation is mentioned in the advisory. Defenders running WidzialniCMS should upgrade to version 2.5 immediately, given the unauthenticated RCE potential, and review web server logs for unusual file uploads to panel upload endpoints or anomalous login attempt patterns as part of a retrospective check.

## Mentioned in this report

- Vulnerabilities: CVE-2026-110468, CVE-2026-110469, CVE-2026-112204, CVE-2026-112205

## Detection guidance (public sample)

### WidzialniCMS Unauthenticated File Upload Endpoint POST Success

ATT&CK: T1190

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs webserver logs. Status: experimental. Generated from the report; not run against telemetry.

Successful POST to the WidzialniCMS save_photo.php or upload.php panel endpoints (CVE-2026-110468/110469), which allow arbitrary file upload and RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: WidzialniCMS Unauthenticated File Upload Endpoint POST Success
description: Detects successful POST requests to the WidzialniCMS /panel/controllers/save_photo.php
  and /panel/upload.php endpoints, abused by CVE-2026-110468 and CVE-2026-110469 for
  unrestricted file upload leading to RCE. Review whether the source is an authenticated
  administrator.
tags:
- attack.initial-access
- attack.t1190
- attack.persistence
- attack.t1505.003
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-stem|endswith:
    - /panel/controllers/save_photo.php
    - /panel/upload.php
    sc-status:
    - 200
    - 201
    - 302
  condition: selection
falsepositives:
- Legitimate authenticated administrators uploading photos or files through the WidzialniCMS
  panel
level: medium
id: fbe47cc7-07f9-5268-be20-ab3a9749f54d
status: experimental
author: Vorant
references:
- https://cert.pl/en/posts/2026/11/CVE-2026-110468
```

### WidzialniCMS Upload Endpoint Path Traversal in Path Parameters

ATT&CK: T1190

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs webserver logs. Status: experimental. Generated from the report; not run against telemetry.

Requests to WidzialniCMS upload endpoints where currentpath or uploadPath contain directory traversal sequences to place files in arbitrary locations. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: WidzialniCMS Upload Endpoint Path Traversal in Path Parameters
description: Detects requests to WidzialniCMS save_photo.php or upload.php carrying
  currentpath or uploadPath parameters with directory traversal sequences, the insufficient
  path validation abused in CVE-2026-110468 and CVE-2026-110469 to write files to
  arbitrary server locations.
tags:
- attack.initial-access
- attack.t1190
- attack.persistence
- attack.t1505.003
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|endswith:
    - /panel/controllers/save_photo.php
    - /panel/upload.php
  selection_param:
    cs-uri-query|contains:
    - currentpath=
    - uploadpath=
  selection_traversal:
    cs-uri-query|contains:
    - ../
    - ..\
    - ..%2f
    - ..%5c
    - '%2e%2e'
  condition: selection_endpoint and selection_param and selection_traversal
falsepositives:
- Custom integrations or scripts that legitimately use relative paths with the upload
  endpoint
level: high
id: a083aef4-165c-547c-84bb-dc17832632e3
status: experimental
author: Vorant
references:
- https://cert.pl/en/posts/2026/11/CVE-2026-110468
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/11/CVE-2026-110468

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/205ba048-966d-5a9d-96e6-c28cb80f2aaa/widzialnicms-flaws-allow-unauthenticated-rce.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup