CVE-2026-30291 Details

An arbitrary file overwrite vulnerability has been identified in the Ora Tools PDF Reader 'Reader & Editor' app, version 4.3.5. This vulnerability allows attackers to overwrite critical internal files through the file import process, potentially leading to arbitrary code execution or unauthorized information exposure. The issue arises from inadequate security validation during file imports, enabling malicious apps to exploit directory traversal and access sensitive data stored in the app's internal storage. This extracted data can be written to shared external storage, where it is accessible to other applications on the device.