CVE-2026-30283

Critical

Published: 31 March 2026

Published

31 March 2026

Modified

06 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0011 28.5th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-30283 is a critical-severity Path Traversal (CWE-22) vulnerability in Peaksel Animal Sounds And Ringtones. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 28.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SC-34 (Non-modifiable Executable Programs).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly validates syntax, content, and data types of file import inputs to block arbitrary path traversal and file overwrites.

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations for logical access to system resources, preventing unauthorized writes to critical internal files.

SC-34 Non-modifiable Executable Programs good match

prevent

Configures critical executable programs as non-modifiable to block overwrites that could lead to arbitrary code execution.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

Why these techniques?

Arbitrary file overwrite (path traversal) in client app file import directly enables remote exploitation for code execution with no auth/UI required.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

An arbitrary file overwrite vulnerability in PEAKSEL D.O.O. NIS Animal Sounds and Ringtones v1.3.0 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

Deeper analysisAI

CVE-2026-30283 is an arbitrary file overwrite vulnerability (CWE-22) in PEAKSEL D.O.O. NIS Animal Sounds and Ringtones version 1.3.0. The flaw allows attackers to overwrite critical internal files via the application's file import process, which can lead to arbitrary code execution or information exposure. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical, and was published on 2026-03-31T18:16:47.313.

The vulnerability is exploitable remotely over the network with low attack complexity, requiring no privileges or user interaction and resulting in no scope change. Attackers without authentication can leverage the file import mechanism to overwrite files, achieving high impacts on confidentiality, integrity, and availability through code execution or data exposure.

Advisories and further details are available in the following references: http://animal.com, https://github.com/Secsys-FDU/AF_CVEs/issues/26, https://peaksel.com/, and https://secsys.fudan.edu.cn/. These sources may provide guidance on patches or mitigations.