CVE-2026-30285 Details

An arbitrary file overwrite vulnerability has been identified in the Zora: Post, Trade, Earn Crypto app, version 2.60.0. This vulnerability allows attackers to overwrite critical internal files through the file import process, potentially leading to arbitrary code execution or exposure of sensitive information. The issue arises from inadequate security validation when handling imported files, enabling a malicious app to manipulate filenames and contents to overwrite important files in the app's internal storage. Such modifications can cause the app to malfunction, fail to launch, or execute unauthorized code. The vulnerability can be exploited automatically once the victim opens the malicious app, without requiring complex user interaction.