CVE-2026-30276 | An arbitrary file overwrite vulnerability in DeftPDF Documen… | CVSS 9.8 CRITICAL

Description

An arbitrary file overwrite vulnerability in DeftPDF Document Translator v54.0 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

Metadata

CVE ID: CVE-2026-30276
State: PUBLISHED
Assigner: mitre
Reserved: 2026-03-04 00:00 UTC
Published: 2026-03-31 00:00 UTC
Last updated: 2026-04-01 18:16 UTC
Primary CWE: CWE-73
CWE-73 External Control of File Name or Path
Vendor / Product: n/a / n/a
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
n/a	n/a	—	n/a

Weakness (CWE)

CWE	Source	Description
—	cna	n/a
CWE-73	adp	CWE-73 External Control of File Name or Path

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	adp	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (3)