CVE-2026-30289

Published Apr 1, 2026 CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Description

An arbitrary file overwrite vulnerability in Tinybeans Private Family Album App v5.9.5-prod allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

Analysis

Technical impact

An attacker can supply a specially crafted file during the import feature of Tinybeans Private Family Album App, allowing them to overwrite essential internal files. The overwrite can trigger execution of arbitrary code or leak sensitive data, making this a serious flaw identified as CWE‑73. The vulnerability is rated with a CVSS score of 8.4, indicating a high severity risk.

Affected Systems

The flaw affects Tinybeans’ Private Family Album App version 5.9.5‑prod. Users running this build on Android devices are at risk, while later releases that have addressed the flaw are not vulnerable. No other vendor or product variants are listed.

Risk and Exploitability

Although the exploit probability is low (EPSS <1 %) and the flaw is not listed in the CISA KEV catalog, the potential for code execution makes it a high‑impact concern. The likely attack path involves delivering a crafted file to the app, which then processes the file and allows path traversal to overwrite protected resources. If users import content from an untrusted source, the vulnerability can be triggered without additional privileges.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

Configuration 1 [-]

cpe:2.3:a:tinybeans:private_family_album:5.9.5:*:*:*:*:android:*:*

No data.

Vendor Product Versions

Tinybeans

Private Family Album App

Version	Status	Scheme	Platform
`5.9.5-prod`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Tinybeans Private Family Album App to a version that contains the fix, if one is available; otherwise, uninstall the application.
Prevent the app from importing files from untrusted or external sources by disabling file import or restricting file permissions.
Monitor device logs for unusual file write activity and consider using security solutions that detect privilege escalation on mobile devices.
Ensure that the device’s operating system and security updates are current to reduce the attack surface.

Generated by OpenCVE AI on April 2, 2026 at 22:00 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.213% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/Secsys-FDU/AF_CVEs/issues/17
https://play.google.com/store/apps/details?id=com.tinybeans
https://secsys.fudan.edu.cn/
https://tinybeans.com/

History

Apr 3, 2026 10:15 AM Title updated. First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
Title	Arbitrary File Overwrite in Tinybeans Private Family Album App Enabling Code Execution
First Time appeared		Tinybeans private Family Album App
Vendors & Products		Tinybeans private Family Album App

Apr 2, 2026 8:30 PM Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
Title		Arbitrary File Overwrite in Tinybeans Private Family Album App Enabling Code Execution
First Time appeared		Tinybeans Tinybeans private Family Album
CPEs		cpe:2.3:a:tinybeans:private_family_album:5.9.5:::::android::
Vendors & Products		Tinybeans Tinybeans private Family Album

Apr 1, 2026 11:45 PM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		An arbitrary file overwrite vulnerability in Tinybeans Private Family Album App v5.9.5-prod allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.
Weaknesses		CWE-73
References		https://github.com/Secsys-FDU/AF_CVEs/issues/17 https://play.google.com/store/apps/details?id=com.tinybeans https://secsys.fudan.edu.cn/ https://tinybeans.com/
Metrics		cvssV3_1 `{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`