External risk intelligence

FLY is FUN Aviation Navigation Arbitrary File Overwrite Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-30278

The vulnerability affects an aviation navigation mobile application designed for local operation on an Android device. File import processes in this context are typically local or user-initiated actions rather than internet-facing services, making public internet exposure and reachability very unlikely.

Path Traversal

Funair Fly Is Fun

35.33

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in a specific version of the FLY is FUN Aviation Navigation application. The flaw could allow an attacker to overwrite important files, potentially leading to unauthorized code execution or exposure of sensitive information. Given the application's nature and the vulnerability's characteristics, the primary concern is to confirm if this specific software is in use and if the vulnerable function is accessible.

Overwrites files, enabling code execution or data leaks.
Matters due to potential for critical system compromise.
Confirm relevance and exposure for aviation navigation app.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by tricking a user into importing a specially crafted file into the application. This could lead to the overwrite of essential files, potentially allowing the attacker to execute their own code or steal sensitive information.

No authentication or user interaction needed.
Triggered by a malicious file import.
Risk of code execution or data exposure.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect critical internal files within the FLY is FUN Aviation Navigation application when a user imports a file. Successful exploitation may lead to the execution of arbitrary code or exposure of sensitive information stored by the application.

Internal application files.
Via a malicious file import.
Arbitrary code execution or data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

The FLY is FUN Aviation Navigation application's arbitrary file overwrite vulnerability (CVE-2026-30278) requires action from application owners and potentially infrastructure or security teams. The first step is to identify all instances of the affected application, confirm its business criticality and exposure, and then assign an accountable owner to plan remediation.

Application owners should lead remediation efforts.
Verify application reachability and business criticality.
Coordinate vendor support for potential fixes.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FLY is FUN Aviation Navigation?

FLY is FUN Aviation Navigation is a mobile software application built for Android devices. It is used by pilots and aviation enthusiasts to assist with flight planning, navigation, and mapping while operating aircraft.

What does CVE-2026-30278 mean in simple terms?

This vulnerability is classified as an arbitrary file overwrite (CWE-22). It means the software fails to properly check where a file is saved during the import process. An attacker can exploit this weakness to replace legitimate internal application files with malicious ones, which can cause the app to run unauthorized code or reveal private data.

How is this vulnerability triggered?

The issue is triggered when the application processes a specially crafted file imported by the user. It does not occur through normal navigation functions or standard map usage; the malicious behavior specifically requires the application to attempt to import and process the compromised file.

Do I need to worry about this if I use the app?

Halo Surface Signal notes that because this is a mobile navigation app designed for local use on Android, it is not typically exposed as an internet-facing service. The risk is limited, as an attacker would generally need a way to deliver a malicious file to the device for the import process to begin.

When should I take action for CVE-2026-30278?

If you are responsible for maintaining this application, start by confirming if you have version 35.33 installed on any devices. Once identified, evaluate how the app is used in your environment and contact the vendor for guidance on available updates or safer alternatives to mitigate the risk of file-based attacks.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.