CVE-2026-28152

HighCVSS 8.1

Published: 24/08/2026(UTC)Updated: 23/10/2026(UTC)Translated: 24/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

40th percentile - higher than 40% of all known CVEs

Summary

Unauthenticated Local File Inclusion in Tonda Core versions prior to 2.6.

Risk Assessment

An unauthenticated attacker can read arbitrary files from the server, potentially leading to disclosure of sensitive data or further system compromise.

Recommendation

Upgrade Tonda Core to version 2.6 or later, which includes the fix.

Other vulnerabilities in Tonda Core

CVE-2026-65477High
The Tonda Core plugin version 2.1.2 and earlier allows a contributor-level Local File Inclusion. A user with contributor role can read arbitrary files from the server.

Original NVD description (English source)

Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS