{"id":"EM-20261109-N05X","url":"https://cyber.eventmonitor.net/incident/EM-20261109-N05X/critical-widzialnicms-vulnerability-cve-2026-110469/","type":"cve","title":"Critical WidzialniCMS Vulnerability (CVE-2026-110469)","subtitle":"CVE-2026-110469","subject":"CVE-2026-110469","status":"Developing","severity":"critical","affected":[],"headline":null,"born":"2026-11-09T13:17:03.910Z","firstSignal":"2026-11-09T10:55:00.000Z","lastSignal":"2026-11-09T13:17:03.910Z","updated":"2026-11-09T15:18:40.970Z","revision":2,"life":[{"status":"Born","at":"2026-11-09T13:17:03.910Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-09T13:17:03.910Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-09T10:55:00.000Z","what":"First signal: C17 CERT Polska"},{"at":"2026-11-09T12:47:25.000Z","what":"Source joined: C8 EU Vulnerability Database (EUVD)"},{"at":"2026-11-09T13:17:03.910Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261109-N05X created."},{"at":"2026-11-09T13:17:03.910Z","what":"Severity raised to Critical by C6"}],"stages":[{"name":"Disclosed","at":"2026-11-09T13:17:03.910Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-09T13:17:03.910Z","detail":"CVSS 10"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":"2026-11-09T10:55:00.000Z","detail":"1 government and CERT sources"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-09T10:55:00.000Z","source":"C17","sourceName":"CERT Polska","role":"Government","severity":2,"title":"Vulnerabilities in WidzialniCMS software","text":"CERT Polska coordinated disclosure of 4 vulnerabilities (CVE-2026-110468, CVE-2026-110469, CVE-2026-112204 and CVE-2026-112205) found in WidzialniCMS software.","url":"https://cert.pl/en/posts/2026/11/CVE-2026-110468/"},{"at":"2026-11-09T12:47:25.000Z","source":"C8","sourceName":"EU Vulnerability Database (EUVD)","role":"Database","severity":4,"title":"EUVD-2026-120045 / CVE-2026-110469 (score 10)","text":"WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to…","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-120045"},{"at":"2026-11-09T13:17:03.910Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":4,"title":"CVE-2026-110469 (CVSS 10)","text":"WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.\n\n\nThis issue has been fixed in version 2.5.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110469"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-09T13:17:03.910","score":10,"severity":"CRITICAL","desc":"WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to…","product":"","seen":1794237520970},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}