Cyber Posture

CVE-2026-30283

Critical

Published: 31 March 2026

Published
31 March 2026
Modified
06 April 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0011 28.5th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

An arbitrary file overwrite vulnerability in PEAKSEL D.O.O. NIS Animal Sounds and Ringtones v1.3.0 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly validates syntax, content, and data types of file import inputs to block arbitrary path traversal and file overwrites.

AC-3 Access Enforcement good match
prevent

Enforces approved authorizations for logical access to system resources, preventing unauthorized writes to critical internal files.

SC-34 Non-modifiable Executable Programs good match
prevent

Configures critical executable programs as non-modifiable to block overwrites that could lead to arbitrary code execution.

Security SummaryAI

CVE-2026-30283 is an arbitrary file overwrite vulnerability (CWE-22) in PEAKSEL D.O.O. NIS Animal Sounds and Ringtones version 1.3.0. The flaw allows attackers to overwrite critical internal files via the application's file import process, which can lead to arbitrary code execution or information exposure. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical, and was published on 2026-03-31T18:16:47.313.

The vulnerability is exploitable remotely over the network with low attack complexity, requiring no privileges or user interaction and resulting in no scope change. Attackers without authentication can leverage the file import mechanism to overwrite files, achieving high impacts on confidentiality, integrity, and availability through code execution or data exposure.

Advisories and further details are available in the following references: http://animal.com, https://github.com/Secsys-FDU/AF_CVEs/issues/26, https://peaksel.com/, and https://secsys.fudan.edu.cn/. These sources may provide guidance on patches or mitigations.

Details

CWE(s)
CWE-22

Affected Products

peaksel
animal sounds and ringtones
1.3.0

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
Why these techniques?

Arbitrary file overwrite (path traversal) in client app file import directly enables remote exploitation for code execution with no auth/UI required.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

References