CVE-2026-30292

Published Apr 1, 2026 CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Description

An arbitrary file overwrite vulnerability in Docudepot PDF Reader: PDF Viewer APP v1.0.34 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

Analysis

Technical impact

An attacker can supply a specially crafted file to the import function of Docudepot PDF Reader: PDF Viewer App v1.0.34, causing the application to overwrite internal files such as executables or configuration data. The overwrite can enable the execution of malicious code or expose sensitive information. The vulnerability originates from a path traversal/incorrect file handling weakness that allows unauthenticated file replacement without validation.

Affected Systems

The vulnerable product is Docudepot PDF Reader: PDF Viewer App version 1.0.34. No other vendors or product versions are listed as affected.

Risk and Exploitability

The severity is high with a CVSS score of 8.4. An EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker delivering a malicious file to the user’s device and tricking or forcing the application to import it, which then triggers the overwrite. The risk is significant because successful exploitation can lead to full code execution or data exposure.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

No data.

Vendor Product Versions

Docudepot

Pdf Reader App

Version	Status	Scheme	Platform
`1.0.34`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Uninstall the Docudepot PDF Reader App until a vendor patch is released or removed from the device
If the app must remain, disable or remove the file import functionality and reduce storage permissions so the app cannot write outside its own sandbox
Actively monitor the vendor’s GitHub or Bitbucket repository, the Apps Store page, and reputable security advisories for an update or correction, and apply any available patch immediately
Consider running the app in a sandboxed or isolated user profile to limit its access to critical system files
Verify the integrity of any file before it is imported, for example by checking checksums or using a digital signature mechanism

Generated by OpenCVE AI on April 2, 2026 at 03:14 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.146% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://docudepot.bitbucket.io/
https://github.com/Secsys-FDU/AF_CVEs/issues/20
https://play.google.com/store/apps/details?id=pdf.pdfreader.pdfeditor.pdfmaker.pdfscanner
https://secsys.fudan.edu.cn/

History

Apr 3, 2026 10:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Docudepot Docudepot pdf Reader App
Vendors & Products		Docudepot Docudepot pdf Reader App

Apr 1, 2026 11:45 PM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		An arbitrary file overwrite vulnerability in Docudepot PDF Reader: PDF Viewer APP v1.0.34 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.
Weaknesses		CWE-73
References		https://docudepot.bitbucket.io/ https://github.com/Secsys-FDU/AF_CVEs/issues/20 https://play.google.com/store/apps/details?id=pdf.pdfreader.pdfeditor.pdfmaker.pdfscanner https://secsys.fudan.edu.cn/
Metrics		cvssV3_1 `{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`