CVE-2026-30278

An arbitrary file overwrite vulnerability in FLY is FUN Aviation Navigation v35.33 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://www.funair.cz/forum	Product
https://secsys.fudan.edu.cn/	Not Applicable

Configurations

Configuration 1 (hide)

cpe:2.3:a:funair:fly_is_fun:35.33:*:*:*:*:android:*:*

History

No history.

Information

Published : 2026-03-31 18:16

Updated : 2026-07-24 20:10

NVD link : CVE-2026-30278

Mitre link : CVE-2026-30278

CVE.ORG link : CVE-2026-30278

JSON object : View

Products Affected

funair

fly_is_fun

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-30278", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30278", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-02T14:18:56.315400Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-03-31T18:16:46.863", "references": [{"url": "http://www.funair.cz/forum", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://secsys.fudan.edu.cn/", "tags": ["Not Applicable"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "An arbitrary file overwrite vulnerability in FLY is FUN Aviation Navigation v35.33 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure."}, {"lang": "es", "value": "Una vulnerabilidad de sobrescritura de archivo arbitrario en FLY is FUN Aviation Navigation v35.33 permite a los atacantes sobrescribir archivos internos cr\u00edticos mediante el proceso de importaci\u00f3n de archivos, lo que lleva a la ejecuci\u00f3n de c\u00f3digo arbitrario o la exposici\u00f3n de informaci\u00f3n."}], "lastModified": "2026-07-24T20:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:funair:fly_is_fun:35.33:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "4A2B2AEC-BDA4-4CC0-916E-7681801A15F2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}