Description

CERT Polska has received a report about vulnerabilities in WidzialniCMS software and participated in coordination of their disclosure.

The vulnerability CVE-2026-110468: WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.

The vulnerability CVE-2026-110469: WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.

The vulnerability CVE-2026-112204: WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint. An attacker can prepare an URL that, when opened, results in arbitrary JavaScript execution in the victim's browser, allowing e.g session cookie theft.

The vulnerability CVE-2026-112205: WidzialniCMS is vulnerable to Bruteforce Protection Bypass in the login functionality. The cookie-based lockout can be bypassed by omitting the login_count and login_timeout cookies, allowing an unauthenticated attacker to perform an unlimited number of login attempts.

These issues have been fixed in version 2.5.

Credits

We thank Kamil Szczurowski, Robert Kruczek (CVE-2026-110468 and CVE-2026-110469) and Mikołaj Matuszewski from CERT.PL (CVE-2026-112204 and CVE-2026-112205) for the responsible vulnerability report.