CVE-2026-30286

critical · 9.8

An arbitrary file overwrite vulnerability in Funambol, Inc. Zefiro Cloud v32.0.2026011614 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

9.8

CVSS

0.6%

EPSS (exploit prob.)

49th

EPSS percentile

2026-03-31

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-22

Affected products

Vendor	Product	Affected versions
funambol	zefiro	32.0.2026011614

Check a specific version with /api/v1/cve/match.

References

https://github.com/Secsys-FDU/AF_CVEs/issues/14
https://play.google.com/store/apps/details?id=com.funambol.zefiro
https://secsys.fudan.edu.cn/
https://zefiro.me/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-30286