CVE-2026-30289

HighPublic PoC

Published: 01 April 2026

Published

01 April 2026

Modified

02 April 2026

KEV Added

—

Patch

—

CVSS Score 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0001 2.6th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-30289 is a high-severity External Control of File Name or Path (CWE-73) vulnerability in Tinybeans Private Family Album. Its CVSS base score is 8.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 2.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly validates file inputs during the import process to prevent malicious overwrites of critical internal files.

AC-3 Access Enforcement good match

prevent

Enforces access control policies to block unauthorized writes to critical files via the import mechanism.

SI-7 Software, Firmware, and Information Integrity partial match

detect

Monitors the integrity of software and critical files to detect unauthorized overwrites from the file import vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

Why these techniques?

Arbitrary file overwrite in local app context directly enables local exploitation for code execution (T1203) and potential privilege escalation (T1068) via internal file manipulation; information exposure is secondary but not mapped to a specific collection technique here.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

An arbitrary file overwrite vulnerability in Tinybeans Private Family Album App v5.9.5-prod allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

Deeper analysisAI

CVE-2026-30289 is an arbitrary file overwrite vulnerability in the Tinybeans Private Family Album App version 5.9.5-prod. The flaw allows attackers to overwrite critical internal files via the file import process, potentially leading to arbitrary code execution or information exposure. It is linked to CWE-73 and carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), highlighting its high severity due to significant impacts on confidentiality, integrity, and availability.

A local attacker can exploit this vulnerability with low attack complexity, requiring no privileges or user interaction. Exploitation involves manipulating the file import mechanism to target and overwrite essential internal files, enabling outcomes such as arbitrary code execution on the device or exposure of sensitive user data stored in the app.

Advisories and further details are available in referenced sources, including the GitHub issue at https://github.com/Secsys-FDU/AF_CVEs/issues/17, the app listing on Google Play at https://play.google.com/store/apps/details?id=com.tinybeans, Secsys Fudan at https://secsys.fudan.edu.cn/, and the Tinybeans website at https://tinybeans.com/. The CVE was published on 2026-04-01T14:16:49.910.