What is GHSA-f99m-gc4m-qgfj?

GHSA-f99m-gc4m-qgfj is a security advisory published by GitHub Security Advisories with Critical severity. WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to...

Which CVE IDs does GHSA-f99m-gc4m-qgfj cover?

GHSA-f99m-gc4m-qgfj covers the following CVE IDs: CVE-2026-110469. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-f99m-gc4m-qgfjCritical

WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to...

Vendor

GitHub Security Advisories

Published

November 9, 2026

Last Modified

November 9, 2026

🔗 CVE IDs covered (1)

CVE-2026-110469 →

📋 Description

WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.

This issue has been fixed in version 2.5.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-110469
https://cert.pl/posts/2026/11/CVE-2026-110468
https://widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175
https://github.com/advisories/GHSA-f99m-gc4m-qgfj