Is CVE-2026-110468 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110468 being exploited in the wild.

How severe is CVE-2026-110468?

Informational severity, published 9 November 2026.

Which products and versions are affected?

Fundacja Widzialni WidzialniCMS before 2.5.

Is there a fix for CVE-2026-110468?

Yes: fixed in 2.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-110468 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-110468?

Check whether you run Fundacja Widzialni WidzialniCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110468: WidzialniCMS unrestricted file upload in save_photo.php

CVE-2026-110468 · Severity: info · Published 2026-11-09

WidzialniCMS is a content management system used to build accessible websites. An unauthenticated attacker can upload arbitrary files to any location on the server by exploiting insufficient validation in the photo upload endpoint, leading to remote code execution and complete compromise of the website.

Technologies: Fundacja Widzialni WidzialniCMS. Vendors: Fundacja Widzialni.

Quick answers

Is CVE-2026-110468 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110468 being exploited in the wild.
How severe is CVE-2026-110468?: Informational severity, published 9 November 2026.
Which products and versions are affected?: Fundacja Widzialni WidzialniCMS before 2.5.
Is there a fix for CVE-2026-110468?: Yes: fixed in 2.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110468 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-110468?: Check whether you run Fundacja Widzialni WidzialniCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.5

Technical details

The vulnerability exists in the /panel/controllers/save_photo.php endpoint due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter. An unauthenticated attacker can bypass the permission check and path validation to upload arbitrary files to any server location, enabling remote code execution. The issue is fixed in version 2.5.

Affected products

Fundacja Widzialni WidzialniCMS before 2.5

Timeline

2026-11-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.