An arbitrary file overwrite flaw in MaruNuri’s Maru app allows an attacker to replace critical internal files through the application’s file import feature, giving the attacker the ability to execute arbitrary code or expose sensitive data. The weakness is classified as a CWE‑73 overwrite of files outside the intended scope.

The vulnerability affects MaruNuri LLC’s Android application "Maru", package name neo.maru, version 2.0.23. No other versions are listed as impacted in the available data.

The CVSS score of 9.8 marks the flaw as critical, while the EPSS score of less than 1% suggests a low current probability of exploitation. The flaw is not yet listed in CISA’s KEV catalog, which limits known exploit activity. Based on the description, the likely attack vector requires an attacker to create a malicious file that a local user imports via the app’s file import function; if performed, the overwritten files would allow remote code execution or data disclosure. Consequently, the risk remains high due to the severity of potential impact, but the practical likelihood hinges on the attacker’s ability to deliver a crafted file to the target device.