CVE-2026-28152

HighCVSS 8.1

Published: 24/08/2026(UTC)Updated: 24/08/2026(UTC)Translated: 24/08/2026(UTC)NVD NIST

Summary

Unauthenticated Local File Inclusion in Tonda Core versions prior to 2.6.

Risk Assessment

An unauthenticated attacker can read arbitrary files from the server, potentially leading to disclosure of sensitive data or further system compromise.

Recommendation

Upgrade Tonda Core to version 2.6 or later, which includes the fix.

Other vulnerabilities in Tonda Core

CVE-2026-65477High
The Tonda Core plugin version 2.1.2 and earlier allows a contributor-level Local File Inclusion. A user with contributor role can read arbitrary files from the server.

Original NVD description (English source)

Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions.