{"id":"CVE-2026-1358","state":"PUBLISHED","title":"Airleader Master Unrestricted Upload of File with Dangerous Type","description":"Airleader Master versions 6.381 and prior allow for file uploads without\n restriction to multiple webpages running maximum privileges. This could\n allow an unauthenticated user to potentially obtain remote code \nexecution on the server.","publishedAt":"2026-02-12T21:24:53.070Z","updatedAt":"2026-03-03T20:23:34.197Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"icscert"},"assigner":"icscert","products":["Airleader GmbH Airleader Master"],"affected":[{"vendor":"Airleader GmbH","product":"Airleader Master","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"6.381","versionType":"custom"}]}],"references":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-043-10","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-043-10.json","https://airleader.us/contact/","https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-044.txt"],"weaknesses":["CWE-434"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/1xxx/CVE-2026-1358.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-1358","state":"PUBLISHED","datePublished":"2026-02-12T21:24:53.070Z","dateUpdated":"2026-03-03T20:23:34.197Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2026-01-22T20:21:20.996Z"},"containers":{"cna":{"title":"Airleader Master Unrestricted Upload of File with Dangerous Type","descriptions":[{"lang":"en","value":"Airleader Master versions 6.381 and prior allow for file uploads without\n restriction to multiple webpages running maximum privileges. This could\n allow an unauthenticated user to potentially obtain remote code \nexecution on the server."}],"affected":[{"vendor":"Airleader GmbH","product":"Airleader Master","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"6.381","versionType":"custom"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-043-10"},{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-043-10.json"},{"url":"https://airleader.us/contact/"},{"url":"https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-044.txt"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.3,"baseSeverity":"CRITICAL","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-434","description":"CWE-434","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2026-03-03T20:23:34.197Z"},"credits":[{"lang":"en","type":"finder","value":"Angel Lomeli of SySS reported this vulnerability to CISA."}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<div>\nAirleader recommends that users upgrade Airleader Master to version 6.386 or later.</div><div><br></div><div>\nUsers of Airleader Master are encouraged to reach out to Airleader via \nemail (info@airleader.us)&nbsp;or submit a web form (<a target=\"_blank\" rel=\"nofollow\" href=\"https://airleader.us/contact/\">https://airleader.us/contact/</a>) for more information and mitigation \nassistance.\n\n<br></div>"}],"value":"Airleader recommends that users upgrade Airleader Master to version 6.386 or later.\n\n\n\n\n\nUsers of Airleader Master are encouraged to reach out to Airleader via \nemail (info@airleader.us) or submit a web form ( https://airleader.us/contact/ ) for more information and mitigation \nassistance."}],"source":{"advisory":"ICSA-26-043-10","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-02-13T16:27:21.432617Z","id":"CVE-2026-1358","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-13T16:27:30.492Z"}}]}}}