MaruNuri LLC CVE-2026-30281

The vulnerability resides in MaruNuri's file import functionality, which fails to properly validate or sanitize file paths during import operations. This allows attackers to specify arbitrary file paths that overwrite existing system or application files. The underlying weakness is path traversal or insufficient input validation on file destinations, enabling an attacker to write malicious content to locations where code execution can be achieved (such as plugin directories, configuration files, or executable locations) or to read sensitive application data by overwriting files with known content. The exact technical mechanism (e.g., zip extraction without path checks, symlink following, or directory traversal) is not specified in available sources.