# WidzialniCMS < 2.5 unauthenticated file upload RCE (CVE-2026-110468, CVE-2026-110469) plus reflected XSS (CVE-2026-112204) and login lockout bypass (CVE-2026-112205)

> CERT Polska disclosed four vulnerabilities in WidzialniCMS (Fundacja Widzialni) affecting all versions before 2.5. Two unauthenticated unrestricted file upload flaws in /panel/controllers/save_photo.php and /panel/upload.php allow upload to arbitrary server locations and lead to remote code execution. A reflected XSS and a cookie-based login lockout bypass were also disclosed; all are fixed in 2.5.

- **Published:** 2026-11-09T13:01:27Z
- **Last reviewed:** 2026-11-09T13:01:27Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5552
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5552.png
- **ID:** TL-2026-5552
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 5
- **CVEs:** CVE-2026-110468, CVE-2026-110469, CVE-2026-112204, CVE-2026-112205, CVE-2025-7065, CVE-2025-8120

## Description

On 2026-11-09 CERT Polska published an advisory covering four vulnerabilities in WidzialniCMS, a content management system from Fundacja Widzialni. All versions before 2.5 are affected and version 2.5 contains the fixes.

CVE-2026-110468 (CWE-434) affects /panel/controllers/save_photo.php. The endpoint trusts a client-controlled permission check and insufficiently validates the currentpath parameter, so an unauthenticated remote attacker can write a file to any location on the server. Writing a server-side script into a web-accessible directory results in remote code execution. CVE-2026-110469 (CWE-434) is the same class of flaw in /panel/upload.php, where the permission check is client-controlled and the uploadPath parameter is not sufficiently validated. Both flaws stem from trusting client-supplied permission parameters and from insufficient validation of path parameters.

CVE-2026-112204 (CWE-79) is a reflected cross-site scripting flaw in /index.php. A victim who opens a crafted URL runs attacker-controlled JavaScript in their browser, which enables theft of session cookies. CVE-2026-112205 (CWE-307) is an ineffective login lockout: the lockout state is kept in the login_count and login_timeout cookies, and an unauthenticated attacker who omits these cookies can make unlimited login attempts, which enables password brute-forcing.

The advisory states no CVSS scores, no in-the-wild exploitation, no public proof of concept, no threat actor attribution, and no IOCs. Severity HIGH is an analyst assessment based on unauthenticated RCE over the network, not a source-stated rating. NVD returned no record for CVE-2026-110468 at the time of research. Earlier, separately tracked upload and permission-bypass CVEs exist for the vendor's related product pad_cms before 1.2.1 (for example CVE-2025-7065 and CVE-2025-8120, per search-index results that could not be fetched directly). Whether they share code lineage with WidzialniCMS is not stated by the source and is not asserted here.

Indicators listed for this threat are the vulnerable endpoints, parameters and cookies named in the advisory, which are useful for log hunting; no network or file-hash IOCs have been published. Credits: Kamil Szczurowski and Robert Kruczek (CVE-2026-110468, CVE-2026-110469); Mikolaj Matuszewski of CERT.PL (CVE-2026-112204, CVE-2026-112205).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1505.003 Web Shell
- T1059 Command and Scripting Interpreter
- T1110.001 Password Guessing
- T1539 Steal Web Session Cookie
- T1204.001 Malicious Link

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**WidzialniCMS Unauthenticated Upload Endpoint Abuse — save_photo.php / upload.php (CVE-2026-110468, CVE-2026-110469)** (`TL-2026-5552-SPL-001`)

Behaviour-first hunt for POST requests to /panel/controllers/save_photo.php and /panel/upload.php, the unauthenticated unrestricted file upload endpoints in WidzialniCMS before 2.5 (CWE-434, CVE-2026-110468 and CVE-2026-110469). Flags anonymous requests and abusive currentpath / uploadPath values (traversal, absolute paths, server-side script extensions) that allow writing a web shell anywhere on the server. Public disclosure only; no in-the-wild exploitation is reported.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1105, T1505.003
- **Data sources:** web:access_combined (Apache/nginx access logs), W3CIISLog, webserver logsource
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=web sourcetype=access_combined earliest=-24h method=POST (uri_path="/panel/controllers/save_photo.php" OR uri_path="/panel/upload.php")
| eval path_arg=urldecode(coalesce(uri_query,""))
| eval path_abuse=if(match(path_arg,"(?i)(^|&)(currentpath|uploadPath)=([.][.]/|/|[a-z]:|[^&]*[.](php|phtml|phar|pht)(&|$))"),1,0)
| eval anonymous=if(isnull(user) OR user="-",1,0)
| where anonymous=1 OR path_abuse=1
| stats count as requests sum(path_abuse) as path_abuse_hits values(status) as status_codes min(_time) as first_seen max(_time) as last_seen by clientip, uri_path, host
| convert ctime(first_seen) ctime(last_seen)
| sort -path_abuse_hits,-requests
```

### Microsoft KQL

```kql
W3CIISLog
| where TimeGenerated > ago(24h)
| where csMethod =~ "POST"
| where csUriStem in~ ("/panel/controllers/save_photo.php", "/panel/upload.php")
| extend Arg = url_decode(csUriQuery)
| extend PathAbuse = Arg matches regex @"(?i)(^|&)(currentpath|uploadPath)=([.][.]/|/|[a-z]:|[^&]*[.](php|phtml|phar|pht)(&|$))"
| extend Anonymous = isempty(csUserName) or csUserName == "-"
| where Anonymous or PathAbuse
| summarize Requests=count(), PathAbuseHits=countif(PathAbuse), StatusCodes=make_set(scStatus, 10), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by cIP, csUriStem, Computer
| project FirstSeen, LastSeen, Computer, cIP, csUriStem, Requests, PathAbuseHits, StatusCodes
| order by PathAbuseHits desc, Requests desc
```

### Sigma

```yaml
title: WidzialniCMS Unauthenticated Upload Endpoint Abuse (CVE-2026-110468 CVE-2026-110469)
id: 3a7e5b1c-94d2-4f06-8c3a-1e2b7d9f6a10
status: experimental
description: Detects POST requests to the vulnerable WidzialniCMS upload endpoints /panel/controllers/save_photo.php and /panel/upload.php that are anonymous or carry an abusive currentpath or uploadPath value, the unrestricted file upload vector that leads to RCE in versions before 2.5.
references:
    - https://cert.pl/en/posts/2026/11/CVE-2026-110468/
author: Threadlinqs Team
date: 2026-11-09
tags:
    - attack.initial-access
    - attack.t1190
    - attack.command-and-control
    - attack.t1105
    - attack.persistence
    - attack.t1505.003
    - cve.2026-110468
    - cve.2026-110469
logsource:
    category: webserver
detection:
    selection_endpoint:
        cs-method: 'POST'
        cs-uri-stem|endswith:
            - '/panel/controllers/save_photo.php'
            - '/panel/upload.php'
    selection_anonymous:
        cs-username: '-'
    selection_path_abuse:
        cs-uri-query|contains:
            - 'currentpath=..'
            - 'currentpath=/'
            - 'currentpath=%2e%2e'
            - 'currentpath=%2f'
            - 'uploadpath=..'
            - 'uploadpath=/'
            - 'uploadpath=%2e%2e'
            - 'uploadpath=%2f'
    condition: selection_endpoint and (selection_anonymous or selection_path_abuse)
falsepositives:
    - Legitimate authenticated CMS administrators uploading photos (the web server log usually shows no username for application sessions)
    - Vulnerability scanners and authorised penetration tests
level: high

```

**Known false positives:**

- Legitimate CMS administrators uploading photos via the panel (access logs rarely show application usernames)
- Authorised vulnerability scans or penetration tests against /panel/

**Tuning notes:** Restrict the search to external client IPs (exclude admin/VPN ranges), set the real index/sourcetype for your web tier, and if the access log records the session cookie, filter requests that carry a valid authenticated session. POST bodies are not logged by default, so enable WAF or request-body logging to see the currentpath/uploadPath form values; the query-string check is best-effort. Patch to WidzialniCMS 2.5.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- WidzialniCMS currentpath / uploadPath Path Manipulation — Arbitrary File Write Attempt (locked: unlock with TL Creds)
- WidzialniCMS Post-Exploitation — Web Server Process Spawning Shell or Download Utility (locked: unlock with TL Creds)
- WidzialniCMS Post-Exploitation — Web Server Process Outbound Connection to Public IP (locked: unlock with TL Creds)
- WidzialniCMS Reflected XSS in index.php — Session Cookie Theft Link (locked: unlock with TL Creds)
- WidzialniCMS Web Shell Execution — Script Request Inside Upload or Media Directory (locked: unlock with TL Creds)
- WidzialniCMS Exploit-to-Web-Shell Chain — Upload POST Then Script Execution in Upload Directory (locked: unlock with TL Creds)
- WidzialniCMS Web Shell Placement — Script File Written by Web Server Process (locked: unlock with TL Creds)
- WidzialniCMS Login Lockout Bypass — High-Volume Logins Without Lockout Cookies (CVE-2026-112205) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [CERT Polska: Vulnerabilities in WidzialniCMS software](https://cert.pl/en/posts/2026/11/CVE-2026-110468/)
- [CERT Polska Coordinated Vulnerability Disclosure policy](https://cert.pl/en/cvd/)
- [NVD: CVE-2026-110468](https://nvd.nist.gov/vuln/detail/CVE-2026-110468)
- [NVD: CVE-2026-110469](https://nvd.nist.gov/vuln/detail/CVE-2026-110469)
- [NVD: CVE-2026-112204](https://nvd.nist.gov/vuln/detail/CVE-2026-112204)
- [NVD: CVE-2026-112205](https://nvd.nist.gov/vuln/detail/CVE-2026-112205)
- [Related earlier vendor issue: CVE-2025-7065 (pad_cms < 1.2.1 photo upload permission bypass RCE)](https://exploit-intel.com/vuln/CVE-2025-7065)
- [Related earlier vendor issue: CVE-2025-8120 (pad_cms < 1.2.1 unrestricted file upload)](https://exploit-intel.com/vuln/CVE-2025-8120)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5552