CVE-2026-59079: Unrestricted File Upload in Edito CMS
Edito CMS restricts the ability to upload files via the UI to specific file types. However, an avatar upload functionality allows an attacker to upload files of any type and extension without restriction. This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Edito CMSto a version that resolves this vulnerability.Fixed in 5.10.2607
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs low-privileged access to the CMS because the vulnerability is in the avatar upload functionality. No user interaction is required.
Which deployments need remediation?
Edito CMS versions before 5.10.2607 are affected. Hotfixes are also available for older 5.8 deployments.
What should be done if an immediate upgrade is not possible?
Apply the available hotfix for version 5.8 where applicable. The provided data does not describe other mitigations.