CVE-2026-28151

HighCVSS 8.1

Published: 24/08/2026(UTC)Updated: 23/10/2026(UTC)Translated: 24/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

40th percentile - higher than 40% of all known CVEs

Summary

Unauthenticated Local File Inclusion in Tonda versions prior to 2.6.

Risk Assessment

An unauthenticated attacker can read arbitrary files from the server, potentially leading to disclosure of sensitive data or further system compromise.

Recommendation

Upgrade Tonda to version 2.6 or later, which includes the fix.

Other vulnerabilities in Tonda

CVE-2026-57805High
The Tonda WordPress plugin contains a PHP Local File Inclusion (LFI) vulnerability due to improper control of filename in include/require statements. The issue affects versions up to and including 2.5.

Original NVD description (English source)

Unauthenticated Local File Inclusion in Tonda < 2.6 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS