External risk intelligence

DeftPDF Document Translator Arbitrary File Overwrite Leading to Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-30276

The vulnerability affects a mobile application (Android) document translator. Mobile apps are typically client-side software rather than network-accessible services or internet-facing infrastructure. The file import process described is a local interaction within the application environment, making public internet exposure of this specific vulnerability extremely unlikely.

Deftpdf Document Translator

54.0

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns an arbitrary file overwrite vulnerability in a document translation technology. If exploited, it could permit attackers to overwrite internal files, potentially leading to code execution or data exposure. The primary concern is confirming relevance and exposure within our environment.

File overwrite flaw in document translator.
Confirms relevance and potential exposure.
Understand risks, verify your usage.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by tricking a user into importing a specially crafted file into the DeftPDF Document Translator. This process could allow the attacker to overwrite crucial system files, potentially leading to the execution of arbitrary code or the exposure of sensitive information.

No authentication required.
Triggered via file import.
Risk of code execution or data exposure.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to overwrite critical internal files when a user imports a file into the DeftPDF Document Translator. This could lead to unauthorized code execution or exposure of sensitive information.

Critical internal files could be overwritten.
Via the file import process.
May lead to code execution or data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

The primary responsibility for addressing this vulnerability lies with the owners of applications that utilize DeftPDF Document Translator, as well as the platform or infrastructure teams managing the Android environment. The initial practical move involves identifying all instances of the affected application, assessing their business criticality and network reachability, and then confirming the accountable owner for remediation planning.

Application owners should lead the remediation.
Verify affected application instances.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is DeftPDF Document Translator?

DeftPDF Document Translator is a mobile application designed for the Android platform that allows users to translate documents. It functions by importing files into the application environment to process and convert them between languages, serving as a client-side tool for document management and translation tasks.

What does arbitrary file overwrite mean in CVE-2026-30276?

This vulnerability falls under the CWE-73 weakness class, which involves improper control of file names or paths. In this specific case, the application fails to safely handle files during the import process. This allows a malicious file to bypass intended restrictions and overwrite critical system files instead of just being processed as intended, which can lead to the unauthorized execution of code or the exposure of sensitive data.

How is this vulnerability triggered?

An attacker triggers this flaw by tricking a user into importing a specially crafted file into the application. The vulnerability is tied to the file import function itself. It is not triggered by background network activity or automated processes that do not involve a user-initiated import of a malicious file.

Is my DeftPDF installation internet-facing?

According to Halo Surface Signal, this vulnerability is very unlikely to be exposed to the internet. Because it affects a mobile Android application, the file import process is a local interaction confined to the device environment. It does not function as a network-accessible service, significantly limiting the potential for remote exploitation compared to server-based software.

How should I respond to this threat advisory?

The first step is to identify all devices within your environment where this specific version of the DeftPDF Document Translator is installed. Once you have a list of affected instances, assess their business use and identify the person or team responsible for the application. Use this information to coordinate with those owners to monitor for official updates or removal, ensuring a structured approach to managing the risk.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.