Security readout for executives and security teams
Plain-English summary
A flaw in UXGROUP LLC's Voice Recorder v10.0 lets a local user trick the app's import feature into overwriting important internal files. That can cause the app to run attacker-supplied code or leak sensitive data. Exploitation requires the victim to interact, but the impact on confidentiality, integrity, and availability is high.
Executive priority
Treat as high priority for any business unit that relies on this consumer-grade recorder on corporate devices. Impact is severe if triggered, but exploitation requires local access and user action, so remediation can follow a normal patch cycle unless the app is widely deployed on sensitive endpoints.
Technical view
CVE-2026-30284 is an external control of file name or path issue (CWE-73) in UXGROUP LLC Voice Recorder v10.0. The file import process does not properly constrain destination paths, allowing an attacker to overwrite critical internal application files. Consequences include arbitrary code execution or information exposure. CVSS 3.1 base score is 8.6 with vector AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, indicating local attack vector, user interaction, and scope change.
Likely exposure
Exposure is limited to endpoints or devices running UXGROUP LLC Voice Recorder v10.0. The local attack vector and required user interaction (importing a crafted file) narrow real-world exposure, but scope change means impact can extend beyond the app's own boundary once triggered.
Exploitation context
No active exploitation is cited. The CVE is not listed in CISA KEV, and public references point to a research disclosure via Fudan University's Secsys group. No public proof-of-concept, exploit code, or in-the-wild activity is named in the provided sources.
Researcher notes
CWE-73 combined with S:C in the CVSS vector suggests the overwrite can affect resources outside the app's own security scope, potentially enabling code execution as another principal. Public references are sparse: vendor identity is not authoritatively confirmed in the CVE record (affected block shows n/a), and the Fudan Secsys AF_CVEs tracker is the primary technical breadcrumb. Validate vendor and platform (mobile vs. desktop) before scoping remediation.
Mitigation direction
- Inventory devices running UXGROUP LLC Voice Recorder v10.0 and prioritize sensitive users.
- Check vendor (UXGROUP LLC / appcraze.co) guidance for a patched release or advisory.
- Until fixed, restrict use of the import feature and avoid opening untrusted files.
- Remove or replace the app on managed devices where business need is low.
- Monitor endpoint logs for unexpected file writes into the app's install directory.
Validation and detection
- Confirm installed Voice Recorder version equals 10.0 via endpoint management tooling.
- Review the AF_CVEs GitHub issue #25 for reproduction details and indicators.
- Test in an isolated lab whether import writes files outside the intended sandbox path.
- Verify presence of any vendor advisory or updated build on appcraze.co.
- Correlate EDR telemetry for anomalous file overwrites tied to the app process.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-73: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-30284 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H1.86CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://secsys.fudan.edu.cn/CVE reference, mitre
- https://appcraze.co/CVE reference, mitre
- https://github.com/Secsys-FDU/AF_CVEs/issues/25CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
External Control of File Name or Path
External Control of File Name or Path represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.