File Upload Vulnerability in Edito CMS by Edito
CVE-2026-59079

7.1HIGH

Key Information:

Vendor: Edito
Status: Edito Cms
Vendor: CVE Published:; 13 November 2026

What is CVE-2026-59079?

Edito CMS, a content management system, has a significant flaw in its avatar upload functionality that permits attackers to bypass file type restrictions. While the application typically restricts uploads to specific file formats, this vulnerability allows the upload of any file type and extension without validation. Affected users are strongly urged to update to version 5.10.2607 or apply the provided hotfixes for earlier versions (5.8) to mitigate this risk.

Affected Version(s)

Edito CMS 0 < 5.10.2607

References

https://cert.pl/posts/2026/11/CVE-2026-59074

third-party-advisory

https://www.edito.pl/

product

CVSS V4

Score:

7.1

Severity:

HIGH

Confidentiality:

None

Integrity:

High

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 13, 2026
Vulnerability Reserved
Jul 2, 2026

Credit

Michał Majchrowicz (AFINE Team)

Dawid Małecki (AFINE Team)

Paweł Zdunek (AFINE Team)

Franciszek Malek

CVE-2026-59079 Data

JSON