CVE-2026-30281

An arbitrary file overwrite vulnerability in MaruNuri LLC v2.0.23 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Secsys-FDU/AF_CVEs/issues/21	Exploit Third Party Advisory
https://maru.xyz/	Product
https://play.google.com/store/apps/details?id=neo.maru	Product
https://secsys.fudan.edu.cn/	Not Applicable

Configurations

Configuration 1 (hide)

cpe:2.3:a:maru:neo.maru:2.0.23:*:*:*:*:android:*:*

History

No history.

Information

Published : 2026-03-31 16:16

Updated : 2026-07-24 20:10

NVD link : CVE-2026-30281

Mitre link : CVE-2026-30281

CVE.ORG link : CVE-2026-30281

JSON object : View

Products Affected

maru

neo.maru

CWE

CWE-73

External Control of File Name or Path

{"id": "CVE-2026-30281", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30281", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-01T18:13:52.483308Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-03-31T16:16:29.820", "references": [{"url": "https://github.com/Secsys-FDU/AF_CVEs/issues/21", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://maru.xyz/", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://play.google.com/store/apps/details?id=neo.maru", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://secsys.fudan.edu.cn/", "tags": ["Not Applicable"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-73"}]}], "descriptions": [{"lang": "en", "value": "An arbitrary file overwrite vulnerability in MaruNuri LLC v2.0.23 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure."}, {"lang": "es", "value": "Una vulnerabilidad de sobrescritura de archivo arbitrario en MaruNuri LLC v2.0.23 permite a los atacantes sobrescribir archivos internos cr\u00edticos a trav\u00e9s del proceso de importaci\u00f3n de archivos, conduciendo a la ejecuci\u00f3n de c\u00f3digo arbitrario o a la exposici\u00f3n de informaci\u00f3n."}], "lastModified": "2026-07-24T20:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:maru:neo.maru:2.0.23:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "73B5E77B-995B-4EAB-A66B-759A22D0804B"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}