CVE-2026-30278 describes an arbitrary file overwrite vulnerability in FLY is FUN Aviation Navigation version 35.33. The vulnerability arises from insufficient validation during the file import process, enabling attackers to overwrite important internal files. Successful exploitation can result in arbitrary code execution or disclosure of sensitive information. The vulnerability is classified under CWE-22 (Path Traversal). The CVSS v3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or vendor advisory is available at this time.

Exploitation of this vulnerability can lead to complete compromise of the affected system by allowing attackers to overwrite critical files. This can result in arbitrary code execution, enabling full control over the system, or exposure of sensitive information. The high CVSS score indicates severe impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the file import functionality and monitor for suspicious activity related to file operations. Avoid importing files from untrusted sources.