Airleader Master versions 6.381 and earlier allow users to upload arbitrary files with no restriction on content type to multiple web pages that run at maximum privileges. The lack of validation for the file type and the execution context permits an unauthenticated attacker to deliver a script or binary that is executed on the server, leading to full compromise of confidentiality, integrity and availability. The weakness is classified as CWE-434, an unsafe file upload flaw.

Airleader GmbH’s Airleader Master application, versions up to and including 6.381, are affected. The fixed version begins with 6.386; all earlier releases carry the vulnerability and should be updated as soon as possible.

The CVSS base score of 9.3 indicates a critical level of risk. EPSS is reported as less than 1%, suggesting a low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an unauthenticated user uploading a malicious file through one of the publicly accessible upload endpoints; the server then executes the uploaded file with full privileges, providing the attacker control over the system. While the probability of exploitation is low at present, the high potential impact warrants prompt mitigation.