{"id":"CVE-2026-1358","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-1358","generatedAt":"2026-10-28T03:39:53.460Z","title":"Airleader Master versions 6.381 and prior allow for file uploads without restriction to multiple webpages running maximum privileges.","description":"Airleader Master versions 6.381 and prior allow for file uploads without\n restriction to multiple webpages running maximum privileges. This could\n allow an unauthenticated user to potentially obtain remote code \nexecution on the server.","published":"2026-02-12T22:16:04.000Z","lastModified":"2026-06-17T10:15:39.000Z","status":"Deferred","sourceIdentifier":"ics-cert@hq.dhs.gov","cvss":{"version":"4.0","score":9.3,"severity":"CRITICAL","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-434"],"affected":[],"epss":{"score":0.01203,"percentile":0.68082,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (1.20%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://airleader.us/contact/","source":"ics-cert@hq.dhs.gov"},{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-043-10.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-043-10","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-044.txt","source":"ics-cert@hq.dhs.gov"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-1358","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}