CVE-2026-30289

HighPublic PoC

Published: 01 April 2026

Published

01 April 2026

Modified

02 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0021 10.4th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-30289 is a high-severity External Control of File Name or Path (CWE-73) vulnerability in Tinybeans Private Family Album. Its CVSS base score is 8.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 10.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2026-30289 is an arbitrary file overwrite vulnerability in the Tinybeans Private Family Album App version 5.9.5-prod. The flaw allows attackers to overwrite critical internal files via the file import process, potentially leading to arbitrary code execution or information exposure. It is linked to CWE-73 and carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), highlighting its high severity due to significant impacts on confidentiality, integrity, and availability.

A local attacker can exploit this vulnerability with low attack complexity, requiring no privileges or user interaction. Exploitation involves manipulating the file import mechanism to target and overwrite essential internal files, enabling outcomes such as arbitrary code execution on the device or exposure of sensitive user data stored in the app.

Advisories and further details are available in referenced sources, including the GitHub issue at https://github.com/Secsys-FDU/AF_CVEs/issues/17, the app listing on Google Play at https://play.google.com/store/apps/details?id=com.tinybeans, Secsys Fudan at https://secsys.fudan.edu.cn/, and the Tinybeans website at https://tinybeans.com/. The CVE was published on 2026-04-01T14:16:49.910.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-17889

Vulnerability details

An arbitrary file overwrite vulnerability in Tinybeans Private Family Album App v5.9.5-prod allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

CWE(s): CWE-73

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

Why these techniques?

Arbitrary file overwrite in local app context directly enables local exploitation for code execution (T1203) and potential privilege escalation (T1068) via internal file manipulation; information exposure is secondary but not mapped to a specific collection technique here.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0