Summaryinfo

A vulnerability labeled as critical has been found in Funambol Zefiro Cloud 32.0.2026011614. This issue affects some unknown processing. Executing a manipulation can lead to Remote Privilege Escalation. This vulnerability is registered as CVE-2026-30286. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in Funambol Zefiro Cloud 32.0.2026011614. It has been declared as critical. This vulnerability affects an unknown part. The manipulation with an unknown input leads to a remote privilege escalation vulnerability. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

An arbitrary file overwrite vulnerability in Funambol, Inc. Zefiro Cloud v32.0.2026011614 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

The advisory is available at secsys.fudan.edu.cn. This vulnerability was named CVE-2026-30286 since 03/04/2026. The exploitation appears to be easy. The attack can be initiated remotely. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 04/01/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• Funambol

Name

• Zefiro Cloud

Version

• 32.0.2026011614

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion