CVE-2026-30276

An arbitrary file overwrite vulnerability in DeftPDF Document Translator v54.0 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://deftpdf.com/	Product
https://github.com/Secsys-FDU/AF_CVEs/issues/22	Exploit Third Party Advisory
https://secsys.fudan.edu.cn/	Not Applicable

Configurations

Configuration 1 (hide)

cpe:2.3:a:deftpdf:document_translator:54.0:*:*:*:*:android:*:*

History

No history.

Information

Published : 2026-03-31 16:16

Updated : 2026-07-24 20:10

NVD link : CVE-2026-30276

Mitre link : CVE-2026-30276

CVE.ORG link : CVE-2026-30276

JSON object : View

Products Affected

deftpdf

document_translator

CWE

CWE-73

External Control of File Name or Path

{"id": "CVE-2026-30276", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30276", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-01T18:15:37.067617Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-03-31T16:16:29.683", "references": [{"url": "https://deftpdf.com/", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/Secsys-FDU/AF_CVEs/issues/22", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://secsys.fudan.edu.cn/", "tags": ["Not Applicable"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-73"}]}], "descriptions": [{"lang": "en", "value": "An arbitrary file overwrite vulnerability in DeftPDF Document Translator v54.0 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure."}, {"lang": "es", "value": "Una vulnerabilidad de sobrescritura de archivo arbitraria en DeftPDF Document Translator v54.0 permite a los atacantes sobrescribir archivos internos cr\u00edticos a trav\u00e9s del proceso de importaci\u00f3n de archivos, llevando a ejecuci\u00f3n de c\u00f3digo arbitrario o exposici\u00f3n de informaci\u00f3n."}], "lastModified": "2026-07-24T20:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:deftpdf:document_translator:54.0:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "213D7F67-1E3F-49B2-A7FA-22ED1F178987"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}