An arbitrary file overwrite vulnerability in Tinybeans Private Family Album App v5.9.5-prod allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.
References
| Link | Resource |
|---|---|
| https://github.com/Secsys-FDU/AF_CVEs/issues/17 | Exploit Third Party Advisory |
| https://play.google.com/store/apps/details?id=com.tinybeans | Product |
| https://secsys.fudan.edu.cn/ | Not Applicable |
| https://tinybeans.com/ | Product |
Configurations
History
02 Apr 2026, 19:40
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:tinybeans:private_family_album:5.9.5:*:*:*:*:android:*:* | |
| References | () https://github.com/Secsys-FDU/AF_CVEs/issues/17 - Exploit, Third Party Advisory | |
| References | () https://play.google.com/store/apps/details?id=com.tinybeans - Product | |
| References | () https://secsys.fudan.edu.cn/ - Not Applicable | |
| References | () https://tinybeans.com/ - Product | |
| First Time |
Tinybeans private Family Album
Tinybeans |
01 Apr 2026, 17:28
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-73 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.4 |
01 Apr 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-01 14:16
Updated : 2026-04-02 19:40
NVD link : CVE-2026-30289
Mitre link : CVE-2026-30289
CVE.ORG link : CVE-2026-30289
JSON object : View
Products Affected
tinybeans
- private_family_album
CWE
CWE-73
External Control of File Name or Path