WidzialniCMS has an Unrestricted File Upload vulnerability in the /panel/upload.php endpoint. An unauthenticated attacker can exploit a client-controlled permission check parameter and insufficient validation of the uploadPath parameter to upload arbitrary files to any location on the server, potentially leading to remote code execution. This vulnerability is fixed in version 2.5.