CVE-2026-30283
Published: 31 March 2026
Summary
CVE-2026-30283 is a critical-severity Path Traversal (CWE-22) vulnerability in Peaksel Animal Sounds And Ringtones. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 40.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SC-34 (Non-modifiable Executable Programs).
Deeper analysis
CVE-2026-30283 is an arbitrary file overwrite vulnerability (CWE-22) in PEAKSEL D.O.O. NIS Animal Sounds and Ringtones version 1.3.0. The flaw allows attackers to overwrite critical internal files via the application's file import process, which can lead to arbitrary code execution or information exposure. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical, and was published on 2026-03-31T18:16:47.313.
The vulnerability is exploitable remotely over the network with low attack complexity, requiring no privileges or user interaction and resulting in no scope change. Attackers without authentication can leverage the file import mechanism to overwrite files, achieving high impacts on confidentiality, integrity, and availability through code execution or data exposure.
Advisories and further details are available in the following references: http://animal.com, https://github.com/Secsys-FDU/AF_CVEs/issues/26, https://peaksel.com/, and https://secsys.fudan.edu.cn/. These sources may provide guidance on patches or mitigations.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17544
Vulnerability details
An arbitrary file overwrite vulnerability in PEAKSEL D.O.O. NIS Animal Sounds and Ringtones v1.3.0 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file overwrite (path traversal) in client app file import directly enables remote exploitation for code execution with no auth/UI required.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly validates syntax, content, and data types of file import inputs to block arbitrary path traversal and file overwrites.
Enforces approved authorizations for logical access to system resources, preventing unauthorized writes to critical internal files.
Configures critical executable programs as non-modifiable to block overwrites that could lead to arbitrary code execution.