An arbitrary file overwrite problem in the FLY is FUN Aviation Navigation application allows an attacker to replace critical internal files by exploiting the file import feature. This can result in the execution of arbitrary code or the exposure of sensitive information, reflecting a file path traversal and unrestricted write weakness (CWE‑22).

The vulnerability applies to Funair’s FLY is FUN Aviation Navigation version 35.33 on Android devices, as identified by the CPE record for that product.

With a CVSS score of 9.8 the flaw is classified as critical. The EPSS score of under 1 % indicates a low projected exploitation chance and the issue is not present in the CISA KEV catalog. Nonetheless, exploitation can likely occur remotely via the import functionality if an attacker can supply or trigger the upload, enabling code execution within the application’s context or leaking confidential data.