What is GHSA-8hgm-3hpp-q8f4?

GHSA-8hgm-3hpp-q8f4 is a security advisory published by GitHub Security Advisories with Critical severity. WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php...

Which CVE IDs does GHSA-8hgm-3hpp-q8f4 cover?

GHSA-8hgm-3hpp-q8f4 covers the following CVE IDs: CVE-2026-110468. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-8hgm-3hpp-q8f4Critical

WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php...

Vendor

GitHub Security Advisories

Published

November 9, 2026

Last Modified

November 9, 2026

🔗 CVE IDs covered (1)

CVE-2026-110468 →

📋 Description

WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.

This issue has been fixed in version 2.5.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-110468
https://cert.pl/posts/2026/11/CVE-2026-110468
https://widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175
https://github.com/advisories/GHSA-8hgm-3hpp-q8f4