CVE-2026-30286
Funambol Zefiro Cloud version 32.0.2026011614 has a flaw that lets attackers overwrite important files by using the file import feature. This can allow attackers to run code or expose sensitive data. The vulnerability is critical.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Funambol Zefiro Cloud version 32.0.2026011614, used by organizations running the Zefiro Cloud platform.
Real-world impact
An attacker could replace or modify critical system files, potentially taking control of the system or exposing confidential information.
Why this severity
The CVSS score of 9.8 reflects that the flaw can be exploited remotely with no authentication or user interaction, and it can lead to complete compromise of confidentiality, integrity, and availability.
What to do about it
- ›Avoid using the file import feature until a patch is released.
- ›If possible, disable the file import functionality.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources.
Timeline
- Mar 31, 2026 · Mar 31, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- github.com/Secsys-FDU/AF_CVEs/issues/1…third party advisory
- play.google.com/store/apps/detailsproduct
- secsys.fudan.edu.cnnot applicable
- zefiro.meproduct