Executive brief
A critical vulnerability exists in the Zefiro Cloud mobile application, which is used for cloud storage and file synchronization. An attacker can remotely overwrite internal system files on a user's device by sending a specially crafted file through the app's import process. This could allow an attacker to take control of the application, steal sensitive user data, or cause the app to stop functioning entirely.
Technical details
An arbitrary file overwrite vulnerability exists in the Zefiro Cloud Android application (com.funambol.zefiro) within the 'com.funambol.a2a.share.ui.A2AReceiveShareActivity' component. The flaw is rooted in insufficient validation of filenames during the file import process, specifically allowing for path traversal (CWE-22). A remote attacker or a malicious local application can provide a crafted filename and content to overwrite sensitive files in the application's internal storage. Successful exploitation can lead to arbitrary code execution by overwriting executable files or privilege escalation and information disclosure by modifying configuration files. The attack requires no complex user interaction and can be triggered automatically when the victim interacts with the malicious import.
Affected products
- Funambol, Inc. Zefiro Cloud 32.0.2026011614
Timeline
- 2026-03-31: disclosed: Initial disclosure via GitHub and NVD
- 2026-03-31: advisory