What is CVE-2026-30278?

CVE-2026-30278 is a critical-severity vulnerability in Funair Fly Is Fun, classified under Path Traversal. CVSS score: 9.8/10. Published 2026-03-31.

How severe is CVE-2026-30278?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Path Traversal in Funair Fly Is Fun

CVE-2026-30278

An arbitrary file overwrite vulnerability in FLY is FUN Aviation Navigation v35.33 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.005 (41.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Funair Fly_is_fun — versions 35.33
N/a — versions n/a

Weakness classification (CWE)

CWE-22 — Path Traversal

References

cve@mitre.org (Broken Link)
cve@mitre.org (Not Applicable)
cve@mitre.org (Product)

Frequently asked questions

What is CVE-2026-30278?: CVE-2026-30278 is a critical-severity vulnerability in Funair Fly Is Fun, classified under Path Traversal. CVSS score: 9.8/10. Published 2026-03-31.
How severe is CVE-2026-30278?: Critical severity. CVSS v3 base score is 9.8 out of 10.