CVE-2026-1358 PUBLISHED

Airleader Master Unrestricted Upload of File with Dangerous Type

Assigner: icscert
Reserved: 22.01.2026 Published: 12.02.2026 Updated: 12.02.2026

Airleader Master versions 6.381 and prior allow for file uploads without restriction to multiple webpages running maximum privileges. This could allow an unauthenticated user to potentially obtain remote code execution on the server.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8

Product Status

Vendor Airleader GmbH
Product Airleader Master
Versions Default: unaffected
  • affected from 0 to 6.381 (incl.)

Solutions

Airleader recommends that users upgrade Airleader Master to version 6.386 or later.

Users of Airleader Master are encouraged to reach out to Airleader via email or submit a web form for more information and mitigation assistance.

Credits

  • Angel Lomeli of SySS reported this vulnerability to CISA finder

References

Problem Types

  • CWE-434 CWE