CVE-2026-1358

critical · 9.3

Airleader Master versions 6.381 and prior allow for file uploads without restriction to multiple webpages running maximum privileges. This could allow an unauthenticated user to potentially obtain remote code execution on the server.

9.3

CVSS

1.2%

EPSS (exploit prob.)

68th

EPSS percentile

2026-02-12

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-434

References

https://airleader.us/contact/
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-043-10.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-043-10
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-044.txt

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-1358