CVE-2026-110469

{
  "etk_id": "ETK-2026-3960",
  "cve_id": "CVE-2026-110469",
  "display_id": "CVE-2026-110469",
  "ghsa_id": "GHSA-f99m-gc4m-qgfj",
  "euvd_id": "EUVD-2026-120045",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unrestricted file upload in WidzialniCMS",
  "summary": "WidzialniCMS versions earlier than 2.5 expose an upload function that does not adequately enforce authorization and destination restrictions. An unauthenticated remote attacker may place chosen files on the server, which can lead to code execution.",
  "mitigation": "Upgrade WidzialniCMS to version 2.5 or later. Restrict public access to the administration upload interface until the upgrade is complete.",
  "vendor": "Fundacja Widzialni",
  "product": "WidzialniCMS",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2.5"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.5"
      ],
      "package_name": "WidzialniCMS",
      "purl": null
    }
  ],
  "cwes": [
    434
  ],
  "cvss_score": 10,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 24.277794483333334,
  "t0_at": "2026-11-09T12:47:25.746000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-09T13:19:08.772834+00:00",
      "days": 0.02202577354166667,
      "is_lower_bound": false,
      "measured_at": "2026-11-09T12:47:25.746000+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-11-10T14:11:59+00:00",
      "days": 1.0587182175925927,
      "is_lower_bound": false,
      "measured_at": "2026-11-09T12:47:25.746000+00:00",
      "url": "https://github.com/im0xfay/CVE-2026-110468-110469-WIDZIALNI"
    },
    "trigger_signal": {
      "at": "2026-11-09T12:47:25.746000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-09T12:47:25.746000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110469"
    }
  }
}