CVE-2026-110469: WidzialniCMS unrestricted file

CISO Take

WidzialniCMS contains an unauthenticated arbitrary file upload flaw in /panel/upload.php: the permission check is controlled by the client and the uploadPath parameter is not validated, so an attacker can drop a web shell anywhere on the server and gain remote code execution. This is a general-purpose CMS rather than an AI/ML framework, so the AI relevance is indirect and applies only where it fronts or hosts ML dashboards, model documentation or data portals. No CVSS, EPSS or KEV data is available, and there is no known public exploit or Nuclei template, but unauthenticated upload-to-RCE bugs are trivial to weaponize once the advisory is public. The package has no tracked dependents and a risk score of 0/100, so the blast radius is limited to organizations running this specific CMS. Upgrade to version 2.5 immediately, and until then block access to /panel/upload.php and review web directories for unexpected files.

Sources:NVDATLAScert.pl

What is the risk?

High for any internet-exposed WidzialniCMS instance below 2.5. The flaw requires no authentication and no user interaction, and the impact is full remote code execution with the web server's privileges. No CVSS vector, EPSS score or KEV listing is available, and no public exploit exists yet, which lowers near-term likelihood but not severity. Exposure to AI/ML systems is indirect and depends on whether the CMS shares a host or network with ML assets.

How does the attack unfold?

Initial Access

Attacker sends an unauthenticated request to /panel/upload.php with a manipulated permission parameter.

AML.T0049

Exploitation

Crafted uploadPath places a malicious script in a web-accessible location on the server.

AML.T0049

Execution

Attacker requests the uploaded web shell to run arbitrary commands as the web server user.

AML.T0050

Impact

Attacker pivots to adjacent hosts and steals credentials, data or ML assets.

Initial Access

Attacker sends an unauthenticated request to /panel/upload.php with a manipulated permission parameter.

AML.T0049

Exploitation

Crafted uploadPath places a malicious script in a web-accessible location on the server.

AML.T0049

Execution

Attacker requests the uploaded web shell to run arbitrary commands as the web server user.

AML.T0050

Impact

Attacker pivots to adjacent hosts and steals credentials, data or ML assets.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
WidzialniCMS	—	—	No patch

Do you use WidzialniCMS? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.7%

chance of exploitation in 30 days

Higher than 54% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

1) Upgrade WidzialniCMS to version 2.5 or later. 2) Until patched, block or restrict access to /panel/upload.php at the WAF, reverse proxy or network layer. 3) Disable script execution (PHP) in upload and writable directories. 4) Audit web roots and upload directories for unexpected PHP or executable files and recent modifications. 5) Monitor web logs for unauthenticated POST requests to /panel/upload.php with unusual uploadPath values. 6) Isolate the CMS host from ML infrastructure and rotate any credentials stored on it if compromise is suspected.

How is it classified?

Code ExecutionAuth BypassFrameworkAML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Risk treatment and response to identified risks

Frequently Asked Questions

What is CVE-2026-110469?

WidzialniCMS contains an unauthenticated arbitrary file upload flaw in /panel/upload.php: the permission check is controlled by the client and the uploadPath parameter is not validated, so an attacker can drop a web shell anywhere on the server and gain remote code execution. This is a general-purpose CMS rather than an AI/ML framework, so the AI relevance is indirect and applies only where it fronts or hosts ML dashboards, model documentation or data portals. No CVSS, EPSS or KEV data is available, and there is no known public exploit or Nuclei template, but unauthenticated upload-to-RCE bugs are trivial to weaponize once the advisory is public. The package has no tracked dependents and a risk score of 0/100, so the blast radius is limited to organizations running this specific CMS. Upgrade to version 2.5 immediately, and until then block access to /panel/upload.php and review web directories for unexpected files.

Is CVE-2026-110469 actively exploited?

No confirmed active exploitation of CVE-2026-110469 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-110469?

1) Upgrade WidzialniCMS to version 2.5 or later. 2) Until patched, block or restrict access to /panel/upload.php at the WAF, reverse proxy or network layer. 3) Disable script execution (PHP) in upload and writable directories. 4) Audit web roots and upload directories for unexpected PHP or executable files and recent modifications. 5) Monitor web logs for unauthenticated POST requests to /panel/upload.php with unusual uploadPath values. 6) Isolate the CMS host from ML infrastructure and rotate any credentials stored on it if compromise is suspected.

What systems are affected by CVE-2026-110469?

This vulnerability affects the following AI/ML architecture patterns: Web content management systems, Web portals fronting ML dashboards.

What is the CVSS score for CVE-2026-110469?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

Web content management systemsWeb portals fronting ML dashboards

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution. This issue has been fixed in version 2.5.

Exploitation Scenario

An attacker scans for WidzialniCMS installations and sends an unauthenticated POST to /panel/upload.php, setting the client-controlled permission parameter to bypass the check and uploadPath to a web-accessible directory. They upload a PHP web shell, request it to get command execution, and then search the host for credentials, API keys or network paths to adjacent ML dashboards and data stores. From there they can pivot to ML infrastructure sharing the same network segment.

Weaknesses (CWE)

CWE-434Unrestricted Upload of File with Dangerous Type

CWE-434 — Unrestricted Upload of File with Dangerous Type: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

[Architecture and Design] Generate a new, unique filename for an uploaded file instead of using the user-supplied filename, so that no external input is used at all.[REF-422] [REF-423]
[Architecture and Design] When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.

Source: MITRE CWE corpus.