CVE-2026-30289

HighCVSS 8.4/10Last modified Jun 17, 2026

Description

An arbitrary file overwrite vulnerability in Tinybeans Private Family Album App v5.9.5-prod allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-73

Affected software

No affected versions have been published.

Timeline

Published: Apr 1, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-30297.5A path traversal and arbitrary file write vulnerability exist in the embedded get function in '_main_.py' in PyMuPDF version, 1.26.5.CVE-2026-302908.4An arbitrary file overwrite vulnerability in InTouch Contacts & Caller ID APP v6.38.1 allows attackers to overwrite critical internal files CVE-2026-302918.4An arbitrary file overwrite vulnerability in Ora Tools PDF Reader ' Reader & Editor APPv4.3.5 allows attackers to overwrite critical interna CVE-2026-302928.4An arbitrary file overwrite vulnerability in Docudepot PDF Reader: PDF Viewer APP v1.0.34 allows attackers to overwrite critical internal fi CVE-2026-3030210.0The command auto-approval module in CodeRider-Kilo contains an OS Command Injection vulnerability, rendering its whitelist security mechanis CVE-2026-303039.8The command auto-approval module in Axon Code contains an OS Command Injection vulnerability, rendering its whitelist security mechanism ine CVE-2026-303049.6In its design for automatic terminal command execution, AI Code offers two options: Execute safe commands and execute all commands. The desc CVE-2026-303059.8Syntx's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism co CVE-2026-303069.8In its design for automatic terminal command execution, SakaDev offers two options: Execute safe commands and execute all commands. The desc CVE-2026-303079.8Roo Code's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism CVE-2026-303089.8In its design for automatic terminal command execution, HAI Build Code Generator offers two options: Execute safe commands and Execute all c CVE-2026-303097.8InfCode's terminal auto-execution module contains a critical command filtering vulnerability that renders its blacklist security mechanism c