WidzialniCMS < 2.5 unauthenticated file upload RCE (CVE-2026-110468, CVE-2026-110469) plus reflected XSS (CVE-2026-112204) and login lockout bypass (CVE-2026-112205)

Key facts

Detection coverage

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5552 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: WidzialniCMS Unauthenticated Upload Endpoint Abuse — save_photo.php / upload.php (CVE-2026-110468, CVE-2026-110469)

Behaviour-first hunt for POST requests to /panel/controllers/save_photo.php and /panel/upload.php, the unauthenticated unrestricted file upload endpoints in WidzialniCMS before 2.5 (CWE-434, CVE-2026-110468 and CVE-2026-110469). Flags anonymous requests and abusive currentpath / uploadPath values (traversal, absolute paths, server-side script extensions) that allow writing a web shell anywhere on the server. Public disclosure only; no in-the-wild exploitation is reported.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1105, T1505.003
• Data sources: web:access_combined (Apache/nginx access logs), W3CIISLog, webserver logsource
• Severity: high
• Confidence: medium

Splunk SPL

index=web sourcetype=access_combined earliest=-24h method=POST (uri_path="/panel/controllers/save_photo.php" OR uri_path="/panel/upload.php")
| eval path_arg=urldecode(coalesce(uri_query,""))
| eval path_abuse=if(match(path_arg,"(?i)(^|&)(currentpath|uploadPath)=([.][.]/|/|[a-z]:|[^&]*[.](php|phtml|phar|pht)(&|$))"),1,0)
| eval anonymous=if(isnull(user) OR user="-",1,0)
| where anonymous=1 OR path_abuse=1
| stats count as requests sum(path_abuse) as path_abuse_hits values(status) as status_codes min(_time) as first_seen max(_time) as last_seen by clientip, uri_path, host
| convert ctime(first_seen) ctime(last_seen)
| sort -path_abuse_hits,-requests

Microsoft KQL

W3CIISLog
| where TimeGenerated > ago(24h)
| where csMethod =~ "POST"
| where csUriStem in~ ("/panel/controllers/save_photo.php", "/panel/upload.php")
| extend Arg = url_decode(csUriQuery)
| extend PathAbuse = Arg matches regex @"(?i)(^|&)(currentpath|uploadPath)=([.][.]/|/|[a-z]:|[^&]*[.](php|phtml|phar|pht)(&|$))"
| extend Anonymous = isempty(csUserName) or csUserName == "-"
| where Anonymous or PathAbuse
| summarize Requests=count(), PathAbuseHits=countif(PathAbuse), StatusCodes=make_set(scStatus, 10), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by cIP, csUriStem, Computer
| project FirstSeen, LastSeen, Computer, cIP, csUriStem, Requests, PathAbuseHits, StatusCodes
| order by PathAbuseHits desc, Requests desc

Sigma

title: WidzialniCMS Unauthenticated Upload Endpoint Abuse (CVE-2026-110468 CVE-2026-110469)
id: 3a7e5b1c-94d2-4f06-8c3a-1e2b7d9f6a10
status: experimental
description: Detects POST requests to the vulnerable WidzialniCMS upload endpoints /panel/controllers/save_photo.php and /panel/upload.php that are anonymous or carry an abusive currentpath or uploadPath value, the unrestricted file upload vector that leads to RCE in versions before 2.5.
references:
    - https://cert.pl/en/posts/2026/11/CVE-2026-110468/
author: Threadlinqs Team
date: 2026-11-09
tags:
    - attack.initial-access
    - attack.t1190
    - attack.command-and-control
    - attack.t1105
    - attack.persistence
    - attack.t1505.003
    - cve.2026-110468
    - cve.2026-110469
logsource:
    category: webserver
detection:
    selection_endpoint:
        cs-method: 'POST'
        cs-uri-stem|endswith:
            - '/panel/controllers/save_photo.php'
            - '/panel/upload.php'
    selection_anonymous:
        cs-username: '-'
    selection_path_abuse:
        cs-uri-query|contains:
            - 'currentpath=..'
            - 'currentpath=/'
            - 'currentpath=%2e%2e'
            - 'currentpath=%2f'
            - 'uploadpath=..'
            - 'uploadpath=/'
            - 'uploadpath=%2e%2e'
            - 'uploadpath=%2f'
    condition: selection_endpoint and (selection_anonymous or selection_path_abuse)
falsepositives:
    - Legitimate authenticated CMS administrators uploading photos (the web server log usually shows no username for application sessions)
    - Vulnerability scanners and authorised penetration tests
level: high

Known false positives:

• Legitimate CMS administrators uploading photos via the panel (access logs rarely show application usernames)
• Authorised vulnerability scans or penetration tests against /panel/

Tuning notes: Restrict the search to external client IPs (exclude admin/VPN ranges), set the real index/sourcetype for your web tier, and if the access log records the session cookie, filter requests that carry a valid authenticated session. POST bodies are not logged by default, so enable WAF or request-body logging to see the currentpath/uploadPath form values; the query-string check is best-effort. Patch to WidzialniCMS 2.5.

• 🔒 WidzialniCMS currentpath / uploadPath Path Manipulation — Arbitrary File Write Attempt · unlock with TL Creds
• 🔒 WidzialniCMS Post-Exploitation — Web Server Process Spawning Shell or Download Utility · unlock with TL Creds
• 🔒 WidzialniCMS Post-Exploitation — Web Server Process Outbound Connection to Public IP · unlock with TL Creds
• 🔒 WidzialniCMS Reflected XSS in index.php — Session Cookie Theft Link · unlock with TL Creds
• 🔒 WidzialniCMS Web Shell Execution — Script Request Inside Upload or Media Directory · unlock with TL Creds
• 🔒 WidzialniCMS Exploit-to-Web-Shell Chain — Upload POST Then Script Execution in Upload Directory · unlock with TL Creds
• 🔒 WidzialniCMS Web Shell Placement — Script File Written by Web Server Process · unlock with TL Creds
• 🔒 WidzialniCMS Login Lockout Bypass — High-Volume Logins Without Lockout Cookies (CVE-2026-112205) · unlock with TL Creds

Indicators of compromise

As of 2026-11-09, Threadlinqs Intelligence tracks 5 indicators of compromise for TL-2026-5552.

Technical analysis

On 2026-11-09 CERT Polska published an advisory covering four vulnerabilities in WidzialniCMS, a content management system from Fundacja Widzialni. All versions before 2.5 are affected and version 2.5 contains the fixes.

CVE-2026-110468 (CWE-434) affects /panel/controllers/save_photo.php. The endpoint trusts a client-controlled permission check and insufficiently validates the currentpath parameter, so an unauthenticated remote attacker can write a file to any location on the server. Writing a server-side script into a web-accessible directory results in remote code execution. CVE-2026-110469 (CWE-434) is the same class of flaw in /panel/upload.php, where the permission check is client-controlled and the uploadPath parameter is not sufficiently validated. Both flaws stem from trusting client-supplied permission parameters and from insufficient validation of path parameters.

CVE-2026-112204 (CWE-79) is a reflected cross-site scripting flaw in /index.php. A victim who opens a crafted URL runs attacker-controlled JavaScript in their browser, which enables theft of session cookies. CVE-2026-112205 (CWE-307) is an ineffective login lockout: the lockout state is kept in the login_count and login_timeout cookies, and an unauthenticated attacker who omits these cookies can make unlimited login attempts, which enables password brute-forcing.

The advisory states no CVSS scores, no in-the-wild exploitation, no public proof of concept, no threat actor attribution, and no IOCs. Severity HIGH is an analyst assessment based on unauthenticated RCE over the network, not a source-stated rating. NVD returned no record for CVE-2026-110468 at the time of research. Earlier, separately tracked upload and permission-bypass CVEs exist for the vendor's related product pad_cms before 1.2.1 (for example CVE-2025-7065 and CVE-2025-8120, per search-index results that could not be fetched directly). Whether they share code lineage with WidzialniCMS is not stated by the source and is not asserted here.

Indicators listed for this threat are the vulnerable endpoints, parameters and cookies named in the advisory, which are useful for log hunting; no network or file-hash IOCs have been published. Credits: Kamil Szczurowski and Robert Kruczek (CVE-2026-110468, CVE-2026-110469); Mikolaj Matuszewski of CERT.PL (CVE-2026-112204, CVE-2026-112205).

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter; T1204.001 Malicious Link

Credential Access

T1110.001 Password Guessing; T1539 Steal Web Session Cookie

Initial Access

T1190 Exploit Public-Facing Application

Persistence

T1505.003 Web Shell

Remediation

Patches

• WidzialniCMS 2.5 (Fundacja Widzialni)

Immediate actions

• Upgrade WidzialniCMS to version 2.5 or later
• Review web server access logs for requests to /panel/controllers/save_photo.php and /panel/upload.php from unauthenticated sessions
• Search web roots and upload directories for unexpected .php or other server-executable files created since deployment

Workarounds

• Restrict access to /panel/ to trusted IP ranges or place it behind VPN or HTTP authentication until upgraded
• Block unauthenticated POST requests to /panel/controllers/save_photo.php and /panel/upload.php at the WAF

Longer-term hardening

• Disallow script execution in upload directories at the web server level
• Rate-limit and monitor authentication attempts at the WAF or reverse proxy rather than relying on client-side cookies
• Set HttpOnly and Secure flags on session cookies to limit XSS cookie theft

Affected and fixed versions

• Fundacja Widzialni — WidzialniCMS
  Vulnerable versions: all versions before 2.5
  Fixed in: 2.5

Timeline

• 2025-09-30 CVE-2025-8120 (CWE-434 unrestricted file upload in the vendor's related pad_cms before 1.2.1) published, per search-index results; shows a prior upload-flaw history in the vendor's software.
• 2026-11-09 WidzialniCMS 2.5 identified as the fixed release for all four vulnerabilities; NVD had no record for CVE-2026-110468 at time of research.
• 2026-11-09 CVE-2026-112204 (reflected XSS in locked-ioc-3) and CVE-2026-112205 (login lockout bypass via omitted login_count/login_timeout cookies) published, both found by CERT.PL's own research.
• 2026-11-09 CVE-2026-110469 published: unauthenticated arbitrary file upload via locked-ioc-2 (uploadPath), leading to RCE.
• 2026-11-09 CVE-2026-110468 published: unauthenticated arbitrary file upload via locked-ioc-1 (currentpath), leading to RCE.
• 2026-11-09 CERT Polska publishes the advisory 'Vulnerabilities in WidzialniCMS software' covering four CVEs, all versions before 2.5 affected.

Sources cited

• CERT Polska: Vulnerabilities in WidzialniCMS software cert.pl · Advisory · 2026-11-09
• CERT Polska Coordinated Vulnerability Disclosure policy cert.pl · Advisory · 2026-11-09
• NVD: CVE-2026-110468 NVD (NIST) · Research · 2026-11-09
• NVD: CVE-2026-110469 NVD (NIST) · Research · 2026-11-09
• NVD: CVE-2026-112204 NVD (NIST) · Research · 2026-11-09
• NVD: CVE-2026-112205 NVD (NIST) · Research · 2026-11-09
• Related earlier vendor issue: CVE-2025-7065 (pad_cms < 1.2.1 photo upload permission bypass RCE) exploit-intel.com · Research · 2025-07-01
• Related earlier vendor issue: CVE-2025-8120 (pad_cms < 1.2.1 unrestricted file upload) exploit-intel.com · Research · 2025-09-30

More in vulnerability

• LNbits Operators Urged to Shut Down Bitcoin Lightning Wallet Servers Amid Active Attacks via Extension Exploit
• CISA adds four KEVs: GPUStack CVE-2026-102895, SignalWire FreeSwitch CVE-2026-116779, OpenBSD OpenSSH CVE-2026-123158, IBM Aspera Faspex CVE-2026-123218
• Able2Shell: 33 N-able N-central Vulnerabilities Chained into RCE and Root Privilege Escalation; N-able Takes Hosted Cloud Offline
• Windows Dangling COM Object Registration Local Privilege Escalation (CVE-2026-66804, incomplete fix for CVE-2026-50343 'Dark Elevator')
• "Office Party" flaw in Anthropic Claude DOCX/PPTX/XLSX skills (soffice.py LD_PRELOAD shim) enables code execution on Linux

Previous and next in vulnerability

• ModSecurity WAF Vulnerabilities: Multipart filename* Upload Bypass (CVE-2026-104269) and XML Body Processor Uninitialized Pointer Dereference (CVE-2026-73857) Previous report
• ForgeRock Attack Chain: Default admin:admin Felix Console Credentials and WAF Path-Encoding Bypass Lead to RCE and Remote Vehicle Unlock at Two Automakers Next report