CVE-2026-30286

CriticalCVSS 9.8/10Last modified Jul 24, 2026

Description

An arbitrary file overwrite vulnerability in Funambol, Inc. Zefiro Cloud v32.0.2026011614 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Secsys-FDU/AF_CVEs/issues/14Third Party Advisory
https://play.google.com/store/apps/details?id=com.funambol.zefiroProduct
https://secsys.fudan.edu.cn/Not Applicable
https://zefiro.me/Product

Timeline

Published: Mar 31, 2026
Last modified: Jul 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-302878.4An arbitrary file overwrite vulnerability in Deep Thought Industries ACE Scanner PDF Scanner v1.4.5 allows attackers to overwrite critical i CVE-2026-302898.4An arbitrary file overwrite vulnerability in Tinybeans Private Family Album App v5.9.5-prod allows attackers to overwrite critical internal CVE-2026-30297.5A path traversal and arbitrary file write vulnerability exist in the embedded get function in '_main_.py' in PyMuPDF version, 1.26.5.CVE-2026-302908.4An arbitrary file overwrite vulnerability in InTouch Contacts & Caller ID APP v6.38.1 allows attackers to overwrite critical internal files CVE-2026-302918.4An arbitrary file overwrite vulnerability in Ora Tools PDF Reader ' Reader & Editor APPv4.3.5 allows attackers to overwrite critical interna CVE-2026-302928.4An arbitrary file overwrite vulnerability in Docudepot PDF Reader: PDF Viewer APP v1.0.34 allows attackers to overwrite critical internal fi CVE-2026-3030210.0The command auto-approval module in CodeRider-Kilo contains an OS Command Injection vulnerability, rendering its whitelist security mechanis CVE-2026-303039.8The command auto-approval module in Axon Code contains an OS Command Injection vulnerability, rendering its whitelist security mechanism ine CVE-2026-303049.6In its design for automatic terminal command execution, AI Code offers two options: Execute safe commands and execute all commands. The desc CVE-2026-303059.8Syntx's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism co CVE-2026-303069.8In its design for automatic terminal command execution, SakaDev offers two options: Execute safe commands and execute all commands. The desc CVE-2026-303079.8Roo Code's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism