QwikSec

Security Database

CVE

CWE

Training

CVE-2022-3008

Published: Sep 5, 2022

Modified: Apr 21, 2025

PUBLISHED

CVSS v3.1

8.1

HIGH

Description

The tinygltf library uses the C library function wordexp() to perform file path expansion on untrusted paths that are provided from the input file. This function allows for command injection by using backticks. An attacker could craft an untrusted path input that would result in a path expansion. We recommend upgrading to 2.6.0 or past commit 52ff00a38447f06a17eab1caa2cf0730a119c751

Vendor	Product	Versions
syoyo	tinygltf	affected `unspecified - < 2.6.0`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

References

https://github.com/syoyo/tinygltf/commit/52ff00a38447f06a17eab1caa2cf0730a119c751

x_refsource_MISC

https://github.com/syoyo/tinygltf/issues/368

x_refsource_MISC

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49053

x_refsource_MISC

https://github.com/syoyo/tinygltf/blob/master/README.md

x_refsource_MISC

vendor-advisory

x_refsource_DEBIAN

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.