CVE-2026-30286

An arbitrary file overwrite vulnerability in Funambol, Inc. Zefiro Cloud v32.0.2026011614 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Secsys-FDU/AF_CVEs/issues/14	Third Party Advisory
https://play.google.com/store/apps/details?id=com.funambol.zefiro	Product
https://secsys.fudan.edu.cn/	Not Applicable
https://zefiro.me/	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:funambol:zefiro:32.0.2026011614:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-31 18:16

Updated : 2026-07-24 20:10

NVD link : CVE-2026-30286

Mitre link : CVE-2026-30286

CVE.ORG link : CVE-2026-30286

JSON object : View

Products Affected

funambol

zefiro

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-30286", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30286", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-02T14:25:59.512724Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-03-31T18:16:47.433", "references": [{"url": "https://github.com/Secsys-FDU/AF_CVEs/issues/14", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://play.google.com/store/apps/details?id=com.funambol.zefiro", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://secsys.fudan.edu.cn/", "tags": ["Not Applicable"], "source": "cve@mitre.org"}, {"url": "https://zefiro.me/", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "An arbitrary file overwrite vulnerability in Funambol, Inc. Zefiro Cloud v32.0.2026011614 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure."}, {"lang": "es", "value": "Una vulnerabilidad de sobrescritura de archivo arbitrario en Funambol, Inc. Zefiro Cloud v32.0.2026011614 permite a los atacantes sobrescribir archivos internos cr\u00edticos a trav\u00e9s del proceso de importaci\u00f3n de archivos, lo que lleva a la ejecuci\u00f3n de c\u00f3digo arbitrario o a la exposici\u00f3n de informaci\u00f3n."}], "lastModified": "2026-07-24T20:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:funambol:zefiro:32.0.2026011614:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "576C1CBB-969A-419F-B2B1-22C6755F70C4"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}