VULNpocalypse
HighVulnerabilityPatch available

CERT Polska reports four WidzialniCMS flaws, fixed in 2.5

CERT Polska reports four vulnerabilities in WidzialniCMS before 2.5, including unauthenticated file upload; upgrade to version 2.5.

Published
Fixed in
WidzialniCMS 2.5
Exploitation
No evidence in the sources; CERT Polska does not report exploitation, so it is not confirmed either way

Live scores

CVE-2026-110468
EPSS
0.006
low predicted chance of attack
VEDAS
0.515
likely exploited
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-110469
EPSS
0.007
low predicted chance of attack
VEDAS
0.514
likely exploited
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-112204
EPSS
0.004
low predicted chance of attack
VEDAS
0.056
little exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-112205
EPSS
0.004
low predicted chance of attack
VEDAS
0.046
little exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

What happened

According to CERT Polska, it received a report about vulnerabilities in WidzialniCMS, a product of Fundacja Widzialni, and took part in coordinating their disclosure. CERT Polska published its advisory on 2026-11-09 and lists four CVEs, all affecting every version before 2.5 CERT Polska.

CERT Polska describes them as follows:

  • CVE-2026-110468: unrestricted file upload (CWE-434) in the /panel/controllers/save_photo.php endpoint. CERT Polska says a client-controlled permission check parameter and insufficient validation of the currentpath parameter let an unauthenticated attacker upload arbitrary files to any location on the server, leading to remote code execution.
  • CVE-2026-110469: unrestricted file upload (CWE-434) in the /panel/upload.php endpoint. CERT Polska describes the same pattern, with insufficient validation of the uploadPath parameter, and the same outcome of remote code execution.
  • CVE-2026-112204: reflected cross-site scripting (CWE-79) in /index.php. CERT Polska says a crafted URL can run arbitrary JavaScript in the victim’s browser, for example allowing session cookie theft.
  • CVE-2026-112205: bypass of brute-force protection (CWE-307) in the login function. CERT Polska says the cookie-based lockout can be bypassed by omitting the login_count and login_timeout cookies, allowing unlimited login attempts.

CERT Polska credits Kamil Szczurowski and Robert Kruczek for the two upload reports, and Mikołaj Matuszewski from CERT.PL for the XSS and brute-force findings.

Not confirmed: whether any of these flaws have been exploited, CVSS scores, and how many installations are affected. The advisory does not state these.

Am I affected?

According to CERT Polska, you are affected if you run WidzialniCMS from Fundacja Widzialni in any version before 2.5. The advisory says version 2.5 fixes these issues. It does not list any other affected products.

Check the installed version in your deployment. If it is below 2.5, treat the site as exposed to the issues above.

What to do now

  1. Identify every WidzialniCMS instance you operate and its version.
  2. Upgrade to version 2.5, the version CERT Polska says contains the fixes.
  3. Read the full CERT Polska advisory for the vendor and product details, and follow the vendor’s update instructions.
  4. Exploitation is not confirmed by the sources, but if an instance stayed on an older version while exposed, consider reviewing it for unexpected files and for unusual login activity. This is a general precaution, not a recommendation from CERT Polska.

Sources