An arbitrary file overwrite flaw in DeftPDF Document Translator v54.0 allows an attacker to replace internal files through the file import routine, potentially executing malicious code or exposing sensitive data. The weakness is a classic example of CWE‑73 Relative Path Traversal, where insufficient validation of file paths permits overwriting protected application files.

The vulnerability impacts the Android version of DeftPDF Document Translator v54.0. Users who can trigger the file import feature are susceptible, and the flaw may affect all installations on Android devices that run this specific software version.

The CVSS score of 9.8 marks it as critical, while an EPSS score of less than 1% indicates a low current exploitation risk. It is not listed in CISA’s KEV catalog, suggesting no widely known public exploits yet. The likely attack vector appears to be local or user‑initiated via the file import function, though this inference is based on the description rather than explicit documentation.