CVE-2026-59079 - Vulnerability Details - OpenCVE

Edito CMS restricts the ability to upload files via the UI to specific file types. However, an avatar upload functionality allows an attacker to upload files of any type and extension without restriction. This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Edito	Edito Cms

No data.

No data.

References

Link	Providers
https://cert.pl/posts/2026/11/CVE-2026-59074
https://www.edito.pl/

History

Sun, 15 Nov 2026 21:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Edito Edito edito Cms
Vendors & Products		Edito Edito edito Cms

Fri, 13 Nov 2026 07:45:00 +0000

Type	Values Removed	Values Added
Description		Edito CMS restricts the ability to upload files via the UI to specific file types. However, an avatar upload functionality allows an attacker to upload files of any type and extension without restriction. This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.
Title		Unrestricted File Upload in Edito CMS
Weaknesses		CWE-434
References		https://cert.pl/posts/2026/11/CVE-2026-59074 https://www.edito.pl/
Metrics		cvssV4_0 `{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: CERT-PL

Published: 2026-11-13T07:28:26.032Z

Updated: 2026-11-13T07:28:26.032Z

Reserved: 2026-07-02T08:57:58.309Z

Link: CVE-2026-59079

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2026-11-13T08:17:18.067

Modified: 2026-11-13T15:40:51.780

Link: CVE-2026-59079

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59079", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2026-07-02T08:57:58.309Z", "datePublished": "2026-11-13T07:28:26.032Z", "dateUpdated": "2026-11-13T07:28:26.032Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-11-13T07:28:26.032Z"}, "title": "Unrestricted File Upload in Edito CMS", "datePublic": "2026-11-12T09:59:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "type": "CWE"}]}], "affected": [{"vendor": "Edito", "product": "Edito CMS", "versions": [{"status": "affected", "version": "0", "lessThan": "5.10.2607", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Edito CMS restricts the ability to upload files via the UI to specific file types. However, an avatar upload functionality\u00a0allows an attacker to upload files of any type and extension without restriction.\nThis issue was fixed in version 5.10.2607.\u00a0 Hotfixes for older versions (5.8)\u00a0have also been released.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Edito CMS restricts the ability to upload files via the UI to specific file types. However, an a<span>vatar upload functionality </span><span>allows an attacker to upload files of any type and extension without restriction.</span><div><br>This issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.</div>"}]}], "references": [{"url": "https://cert.pl/posts/2026/11/CVE-2026-59074", "tags": ["third-party-advisory"]}, {"url": "https://www.edito.pl/", "tags": ["product"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Micha\u0142 Majchrowicz (AFINE Team)", "type": "finder"}, {"lang": "en", "value": "Dawid Ma\u0142ecki (AFINE Team)", "type": "finder"}, {"lang": "en", "value": "\u200bPawe\u0142 Zdunek (AFINE Team)", "type": "finder"}, {"lang": "en", "value": "Franciszek Malek", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.3"}}}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Edito CMS", "vendor": "Edito", "versions": [{"lessThan": "5.10.2607", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cvd@cert.pl"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Edito CMS restricts the ability to upload files via the UI to specific file types. However, an avatar upload functionality\u00a0allows an attacker to upload files of any type and extension without restriction.\nThis issue was fixed in version 5.10.2607.\u00a0 Hotfixes for older versions (5.8)\u00a0have also been released."}], "id": "CVE-2026-59079", "lastModified": "2026-11-13T15:40:51.780", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}]}, "published": "2026-11-13T08:17:18.067", "references": [{"source": "cvd@cert.pl", "url": "https://cert.pl/posts/2026/11/CVE-2026-59074"}, {"source": "cvd@cert.pl", "url": "https://www.edito.pl/"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "cvd@cert.pl", "type": "Primary"}]}