{"id":"CVE-2026-1358","aliases":["EUVD-2026-6159","GHSA-m2gf-58fp-54j4"],"status":"published","title":"Airleader Master Unrestricted Upload of File with Dangerous Type","description":"Airleader Master versions 6.381 and prior allow for file uploads without\n restriction to multiple webpages running maximum privileges. This could\n allow an unauthenticated user to potentially obtain remote code \nexecution on the server.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01185,"percentile":0.68269,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-434"],"published":"2026-02-12T21:24:53Z","modified":"2026-06-17T10:15:39Z","products":[{"vendor":"airleader gmbh","product":"airleader master"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-043-10"},{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-043-10.json"},{"url":"https://airleader.us/contact/"},{"url":"https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-044.txt"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1358"},{"url":"https://airleader.us/contact"},{"url":"https://github.com/advisories/GHSA-m2gf-58fp-54j4"}],"sources":{"cve":[{"id":"CVE-2026-1358","title":"Airleader Master Unrestricted Upload of File with Dangerous Type","description":"Airleader Master versions 6.381 and prior allow for file uploads without\n restriction to multiple webpages running maximum privileges. This could\n allow an unauthenticated user to potentially obtain remote code \nexecution on the server.","status":"published","published":"2026-02-12T21:24:53.07Z","modified":"2026-03-03T20:23:34.197Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:20:01.271368Z"}],"euvd":[{"id":"EUVD-2026-6159","description":"Airleader Master versions 6.381 and prior allow for file uploads without\n restriction to multiple webpages running maximum privileges. This could\n allow an unauthenticated user to potentially obtain remote code \nexecution on the server.","status":"published","published":"2026-02-12T21:24:53Z","modified":"2026-03-03T20:23:34Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T19:48:11.637968Z"}],"ghsa":[{"id":"GHSA-m2gf-58fp-54j4","title":"Airleader Master versions 6.381 and prior allow for file uploads without\n restriction to multiple...","description":"Airleader Master versions 6.381 and prior allow for file uploads without\n restriction to multiple webpages running maximum privileges. This could\n allow an unauthenticated user to potentially obtain remote code \nexecution on the server.","status":"published","published":"2026-02-13T00:32:51Z","modified":"2026-03-03T21:31:09Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:06:26.357639Z"}],"nvd":[{"id":"CVE-2026-1358","description":"Airleader Master versions 6.381 and prior allow for file uploads without\n restriction to multiple webpages running maximum privileges. This could\n allow an unauthenticated user to potentially obtain remote code \nexecution on the server.","status":"published","published":"2026-02-12T22:16:04.213Z","modified":"2026-06-17T10:15:39.37Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:12:05.908608Z"}]}}