by Kastro
Paper/Archive/CVE-2026-1358

CVE-2026-1358

Airleader GmbH Airleader Master — Airleader Master Unrestricted Upload of File with Dangerous Type

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 68.3.683 × 2013.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Airleader Master versions 6.381 and prior allow for file uploads without restriction to multiple webpages running maximum privileges. This could allow an unauthenticated user to potentially obtain remote code execution on the server.

Affected

ProductAffectedFixed inSource
Airleader Master≤ 6.381–CNA

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-26-043-10refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-043-10.jsonrefairleader.us/contactrefsyss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-044.txt