What is GHSA-f776-3w9r-9mc5?

GHSA-f776-3w9r-9mc5 is a security advisory published by GitHub Security Advisories with High severity. Edito CMS restricts the ability to upload files via the UI to specific file types. However, an...

Which CVE IDs does GHSA-f776-3w9r-9mc5 cover?

GHSA-f776-3w9r-9mc5 covers the following CVE IDs: CVE-2026-59079. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-f776-3w9r-9mc5High

Edito CMS restricts the ability to upload files via the UI to specific file types. However, an...

Vendor

GitHub Security Advisories

Published

November 13, 2026

Last Modified

November 13, 2026

🔗 CVE IDs covered (1)

CVE-2026-59079 →

📋 Description

Edito CMS restricts the ability to upload files via the UI to specific file types. However, an avatar upload functionality allows an attacker to upload files of any type and extension without restriction. This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-59079
https://cert.pl/posts/2026/11/CVE-2026-59074
https://www.edito.pl
https://github.com/advisories/GHSA-f776-3w9r-9mc5