CVE-2022-3008: The tinygltf library uses the C library function wordexp() to perform file path expansion on untrusted paths that are provided from the input file. This…

PriorityP348high8.8CVSS 3.1

AVNACLPRNUIRSUCHIHAH

EPSS

2.79%

85.0th percentile

The tinygltf library uses the C library function wordexp() to perform file path expansion on untrusted paths that are provided from the input file. This function allows for command injection by using backticks. An attacker could craft an untrusted path input that would result in a path expansion. We recommend upgrading to 2.6.0 or past commit 52ff00a38447f06a17eab1caa2cf0730a119c751

Affected

11 ranges

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	tinygltf	< tinygltf 2.5.0+dfsg-5 (bookworm)	tinygltf 2.5.0+dfsg-5 (bookworm)
linux	linux_kernel	>= 5.13.0 < 5.15.86	5.15.86
linux	linux_kernel	>= 5.16.0 < 6.0.16	6.0.16
linux	linux_kernel	>= 6.1.0 < 6.1.2	6.1.2
syoyo	tinygltf	>= unspecified < 2.6.0	2.6.0
tinygltf_project	tinygltf	< 2.6.0	2.6.0
tinygltf_project	tinygltf	>= 0 < 2.5.0+dfsg-3+deb11u1	2.5.0+dfsg-3+deb11u1
tinygltf_project	tinygltf	>= 0 < 2.5.0+dfsg-5	2.5.0+dfsg-5
tinygltf_project	tinygltf	>= 0 < 2.5.0+dfsg-5	2.5.0+dfsg-5
tinygltf_project	tinygltf	>= 0 < 2.5.0+dfsg-5	2.5.0+dfsg-5

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

osv8.8HIGH

vendor_debian8.1HIGH

vendor_redhat2.5LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.