EUVD-2026-17538Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
An arbitrary file overwrite vulnerability in FLY is FUN Aviation Navigation v35.33 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.
AnalysisAI
Arbitrary file overwrite in FLY is FUN Aviation Navigation v35.33 permits attackers to overwrite critical internal files through the file import process, enabling remote code execution or information disclosure. No CVSS score, CVE severity classification, or patch status has been established. The vulnerability affects a niche aviation navigation software product with limited public disclosure.
Technical ContextAI
The vulnerability exists in the file import functionality of FLY is FUN Aviation Navigation software. The root cause appears to involve insufficient validation or sanitization of file paths during the import process, allowing attackers to specify arbitrary file destinations rather than the intended import directory. This path traversal or file overwrite mechanism could permit modification of executable code, configuration files, or sensitive data stored by the application. The affected product is a specialized aviation navigation tool; the underlying technology and specific file handling implementation cannot be fully determined from available data, as CWE classification and detailed technical specifications are absent from the provided intelligence.
RemediationAI
No vendor-released patch version has been identified at the time of analysis. Organizations running FLY is FUN Aviation Navigation v35.33 should immediately contact the vendor (http://fly.com) to request a patched version, security advisory, or interim mitigation guidance. If the file import function is not operationally required, disabling or restricting access to the import feature may reduce exposure. Users should avoid importing files from untrusted sources and ensure the application is run with minimal necessary privileges. Monitor the vendor's website and the referenced advisory channels (http://fly.com, https://secsys.fudan.edu.cn/, http://www.funair.cz/forum) for patch availability announcements.
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by ge
An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a proce
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today