What is the CVSS score of CVE-2026-30290?

CVE-2026-30290 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

InTouch Contacts CVE-2026-30290

EUVD-2026-17596 HIGH

Path Traversal (CWE-22)

2026-03-31 mitre

Path Traversal RCE Information Disclosure

8.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 31, 2026 - 19:47 euvd

EUVD-2026-17596

Analysis Generated

Mar 31, 2026 - 19:47 vuln.today

CVE Published

Mar 31, 2026 - 00:00 nvd

HIGH 8.4

DescriptionCVE.org

An arbitrary file overwrite vulnerability in InTouch Contacts & Caller ID APP v6.38.1 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

AnalysisAI

Arbitrary file overwrite in InTouch Contacts & Caller ID APP v6.38.1 allows remote attackers to overwrite critical internal files through the file import process, enabling arbitrary code execution or sensitive information exposure. Affected versions are limited to 6.38.1; no CVSS score, EPSS, or active exploitation status (KEV) is available at this time, though the vulnerability chain to RCE presents material risk.

Technical ContextAI

The vulnerability exists in the file import functionality of InTouch Contacts & Caller ID APP. The application fails to properly validate or restrict file paths during import operations, allowing an attacker to specify arbitrary file system locations for writing imported content. This path traversal or insufficient input validation issue (CWE class not formally assigned but consistent with CWE-22: Improper Limitation of a Pathname to a Restricted Directory) permits overwriting system or application files. Successful file overwrite can lead to code execution if critical executable or configuration files are targeted, or information disclosure if sensitive files are read or corrupted. The CPE data provided (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*) indicates incomplete vulnerability database metadata; the actual affected product is InTouch Contacts & Caller ID APP.

RemediationAI

Upgrade InTouch Contacts & Caller ID APP to a version newer than 6.38.1 when available. At this time, no specific patched version number has been publicly announced; check the vendor's official website (intouchapp.com) or application update mechanism for the latest release. Immediate mitigation pending patch: restrict file import functionality to trusted sources only, run the application with minimal user privileges, and monitor file system activity for unauthorized writes to system or application directories. Users should review the GitHub issue at https://github.com/Secsys-FDU/AF_CVEs/issues/19 for additional technical details and any vendor response.