CVE-2026-30286

CVE-2026-30286 is a critical arbitrary file overwrite vulnerability affecting Funambol, Inc. Zefiro Cloud v32.0.2026011614, stemming from its file import process. Rated 9.8 CVSS Critical, this flaw allows unauthenticated attackers to remotely overwrite critical internal files with low attack complexity and no user interaction. Successful exploitation can lead to severe consequences, including arbitrary code execution and extensive information exposure. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed on CISA's KEV catalog. Despite the lack of current exploitation, its high severity necessitates prompt patching.