CVE-2026-1358CWE-434

Airleader Master Unrestricted Upload of File with Dangerous Type

Critical · published February 12, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
68.0
In the wild
Unconfirmed
What it is

Airleader Master versions 6.381 and prior allow for file uploads without

restriction to multiple webpages running maximum privileges. This could

allow an unauthenticated user to potentially obtain remote code

execution on the server.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01203 · 68.0th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-02-12T21:24Z
EPSS history
Timeline
  • 12 FEB 21:24Z
    Airleader Master Unrestricted Upload of File with Dangerous Type
    cvelistv5