WidzialniCMS contains an Unrestricted File Upload vulnerability in the /panel/controllers/save_photo.php endpoint. An unauthenticated attacker can exploit a client-controlled permission check parameter and insufficient validation of the currentpath parameter to upload arbitrary files to any location on the server. This can lead to remote code execution. The vulnerability has been fixed in version 2.5.