CVE-2026-30278: An arbitrary file overwrite vulnerability in FLY is FUN Aviation Navigation v35.33 allows attackers to over...

Security readout for executives and security teams

FLY is FUN Aviation Navigation v35.33, a flight navigation app used by pilots, contains a flaw that lets an attacker overwrite important internal files when the app imports a file. That overwrite can lead to the app running attacker-chosen code or leaking sensitive information. In practical terms, a poisoned import file could compromise the pilot's device or its navigation data. Exposure is limited to installations of FLY is FUN Aviation Navigation v35.33, primarily on pilot or aviation-enthusiast mobile/tablet devices. Enterprise fleet exposure is likely low unless an organization distributes or supports the app. Risk rises for any user who imports flight plans, waypoints, or configuration files from untrusted sources such as forums, email, or shared links. Priority is elevated but narrowly scoped: act if your organization uses this app, otherwise informational. Communicate guidance to any pilots or aviation staff using v35.33 to stop importing untrusted files and to watch for a vendor fix. Track for change in exploitation status; escalate if KEV listing, public exploit, or vendor patch appears. Mitigation focus: Inventory devices running FLY is FUN Aviation Navigation and identify anyone on v35.33.; Check the vendor site (funair.cz) for a fixed release or advisory before continuing use.; Instruct users to avoid importing flight plans or files from untrusted or unverified sources..

Prepared

Jul 11, 2026, 06:31 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.