CVE-2026-30280: Rareprob Video Player RCE Vulnerability

CVE-2026-30280 Overview

CVE-2026-30280 is an arbitrary file overwrite vulnerability in the Rareprob Solutions Private Limited Video Player - Play All Videos Android application, version 1.0.135. The flaw exists in the application's file import process. An attacker can craft a malicious file that, when imported by the user, overwrites critical internal application files. Successful exploitation can lead to arbitrary code execution within the app context or exposure of sensitive information stored by the application. The issue is classified under CWE-434: Unrestricted Upload of File with Dangerous Type. Exploitation requires local access and user interaction to trigger the import.

Critical Impact
Attackers can overwrite internal application files through the file import process, enabling arbitrary code execution or disclosure of locally stored data.

Affected Products

Rareprob Video Player - Play All Videos v1.0.135 (Android)
CPE: cpe:2.3:a:rareprob:video_player:1.0.135:*:*:*:*:android:*:*
Vendor: Rareprob Solutions Private Limited

Discovery Timeline

2026-03-31 - CVE-2026-30280 published to NVD
2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-30280

Vulnerability Analysis

The Rareprob Video Player exposes a file import capability that processes user-supplied files without sufficient validation of the destination path or file identity. When a user imports a media file or related resource, the application writes the content into its internal storage area. An attacker who controls the imported file's name, path, or metadata can direct the write operation to overwrite files the application relies on at runtime.

Because the affected files reside in the application's private storage, overwriting them can corrupt configuration data, replace cached executable artifacts such as scripts or DEX-like resources, or substitute trusted data files used by the player. Depending on which file is overwritten, the result ranges from information exposure to attacker-controlled code paths during subsequent app execution.

The vulnerability is local in scope. The attacker must deliver the malicious file to the device and convince the user to import it through the application's standard workflow.

Root Cause

The root cause is missing validation during the file import routine. The application does not adequately verify the destination path, file type, or integrity before writing imported content into its private directory. This maps to CWE-434, where unrestricted handling of an uploaded or imported file allows it to occupy a sensitive location.

Attack Vector

Exploitation requires local access to the Android device and user interaction. The attacker delivers a crafted file through any standard channel such as messaging, email attachment, removable media, or a download. The user then imports the file using the affected Video Player. The import routine writes attacker-controlled content over an internal file, after which the application's next read or execution of that file produces the attacker's intended effect.

The vulnerability mechanism is described in the public technical reference; see the GitHub issue tracking AF_CVEs for additional analysis.

Detection Methods for CVE-2026-30280

Indicators of Compromise

Unexpected modification timestamps on files inside the application's private data directory /data/data/com.rareprob.*/.
Imported files with traversal sequences such as ../ in their names, or with extensions that do not match the expected media types.
New or altered configuration, cache, or script-like resources within the Video Player's storage that were not produced by a legitimate app operation.

Detection Strategies

Inspect imported file names and paths during static or dynamic analysis of the Video Player application for path traversal or unexpected destination resolution.
Use Android file integrity monitoring on managed devices to flag changes to files inside the Rareprob Video Player's private data directory outside of normal install or update events.
Review mobile threat defense telemetry for installations of com.rareprob.videoplayer.allvideodownloader (and related package identifiers) at version 1.0.135.

Monitoring Recommendations

Track Mobile Device Management (MDM) inventory for Android endpoints running the affected version and prioritize them for update or removal.
Monitor file-sharing channels and email gateways for media files paired with secondary payload files targeting the Video Player import flow.
Correlate user reports of unexpected app behavior, crashes, or content changes in the Video Player with recent file imports.

How to Mitigate CVE-2026-30280

Immediate Actions Required

Identify all Android devices running Rareprob Video Player v1.0.135 and restrict use of the file import feature until a patched version is installed.
Instruct users not to import media files received from untrusted sources into the Video Player.
Remove the application from devices that handle sensitive corporate data until the vendor publishes a fix.

Patch Information

No vendor advisory or patched release has been published at the time of writing. Monitor the vendor's site at Rareprob and the AF_CVEs tracking issue for updates. Upgrade to a version later than 1.0.135 as soon as the vendor releases a fix.

Workarounds

Disable or avoid the file import feature in the Rareprob Video Player.
Use Android work profile separation or MDM policies to block the application on devices that process sensitive data.
Source media files only from trusted locations and validate file extensions before importing them into media applications.

bash

# Example MDM policy: block the affected package on managed Android devices
adb shell pm disable-user --user 0 com.rareprob.videoplayer.allvideodownloader