CVE-2026-30281 Details

An arbitrary file overwrite vulnerability has been identified in the neo.maru app by MaruNuri LLC, specifically in version 2.0.23. This vulnerability allows attackers to overwrite critical internal files through the file import process, potentially leading to arbitrary code execution or exposure of sensitive information. The issue arises from inadequate security validation when handling imported files, enabling a malicious app to manipulate filenames and contents to overwrite sensitive files in the app's internal storage. Modifying essential configuration or executable files could cause the app to malfunction, fail to launch, or execute unauthorized code. Notably, this vulnerability can be exploited automatically without complex user interaction, once the victim opens the malicious app.