CVE-2026-57801

Name of the Vulnerable Software and Affected Versions SetSail versions prior to 2.2

Description SetSail is subject to a Local File Inclusion issue, which occurs when a program improperly controls filenames used in include or require statements. This allows authenticated attackers with contributor-level access and above to include and execute arbitrary files on the server. By exploiting this, an attacker can execute PHP code contained within those files, bypass access controls, or obtain sensitive data, particularly when images or other safe file types can be uploaded and subsequently included.

Recommendations Update SetSail to a version newer than 2.1.