CVE-2026-1835 lcg0124 BootDo cross-site request forgery
Attackers can perform unauthorized actions on behalf of authenticated users in the BootDo web application via cross-site request forgery.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-1835?
CVE-2026-1835 is a medium-severity vulnerability in lcg0124 BootDo, published on 4 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability was identified in lcg0124 BootDo up to e93dd428ef6f5c881aa74d49a2099ab0cf1e0fcb. This affects an unknown part. The manipulation leads to cross-site request forgery. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified.
Which versions are affected by CVE-2026-1835?
How do I fix CVE-2026-1835?
No fix has been published for CVE-2026-1835 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-1835 being exploited?
There is no known exploitation of CVE-2026-1835 in the wild and no public exploit code.
Sources
Also known as GHSA-9pg8-g8f8-c4jx.