CVE-2026-30276
An attacker can overwrite critical internal files in DeftPDF Document Translator v54.0 by using the file import feature. This flaw can lead to arbitrary code execution or the disclosure of sensitive information. The vulnerability is severe because it can be exploited remotely without authentication.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
DeftPDF Document Translator version 54.0.
Real-world impact
An attacker who successfully exploits this flaw can replace essential system files, potentially running malicious code or leaking confidential data from the application.
Why this severity
The CVSS score of 9.8 reflects a network‑based attack that requires no user interaction, no privileges, and no authentication. The vulnerability compromises confidentiality, integrity, and availability, giving the attacker full control over the affected system.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Mar 31, 2026 · Mar 31, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- deftpdf.comproduct
- github.com/Secsys-FDU/AF_CVEs/issues/2…exploitthird party advisory
- secsys.fudan.edu.cnnot applicable