---
id: CVE-2026-30278
title: >-
  An arbitrary file overwrite vulnerability in FLY is FUN Aviation Navigation
  v35.33 allows attackers to overwrite critical internal files via the file
  import process, leading to arbitrary code execution or information exposure.
summary: >-
  An arbitrary file overwrite vulnerability in FLY is FUN Aviation Navigation
  v35.33 allows attackers to overwrite critical internal files via the file
  import process, leading to arbitrary code execution or information exposure.
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-22
vendor: funair
product: fly_is_fun
affected:
  - fly_is_fun = 35.33
published: '2026-03-31'
updated: '2026-07-24'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-30278'
references:
  - url: 'http://www.funair.cz/forum'
    label: cve@mitre.org
  - url: 'https://secsys.fudan.edu.cn/'
    label: cve@mitre.org
tags:
  - nvd
epss: 0.00534
epssPercentile: 0.44036
ingestedAt: '2026-07-24T20:38:03.052Z'
---

## Overview

An arbitrary file overwrite vulnerability in FLY is FUN Aviation Navigation v35.33 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

## Affected

- `fly_is_fun = 35.33`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.