Technical impact
Assimp versions up to 6.0.6 include a path traversal flaw in the glTF and glTF2 importers that allows an attacker to read arbitrary local files. By crafting the buffers[].uri field with ".." components or absolute paths, a malicious glTF model can be used to load sensitive files such as /etc/passwd into the imported mesh data. The vulnerability does not allow arbitrary code execution but does compromise confidentiality by exposing file contents to the application.
Affected Systems
The flaw affects the Assimp library from the assimp:assimp vendor, specifically all releases up to and including 6.0.6. Systems that statically or dynamically link with these versions and process untrusted glTF models are at risk. The issue was reported in the glTF2Asset.inl source file and tracked on the Assimp GitHub project.
Risk and Exploitability
The CVSS score of 6.8 classifies the issue as a moderate severity vulnerability. No EPSS score is available and the flaw is not listed in the CISA KEV catalog, indicating no known active exploitation. The likely attack vector involves supply of a malicious model to an application that loads it without additional path validation or permission checks. If exploited, the attacker could read sensitive local files, potentially aiding further attacks such as privilege escalation or data exfiltration.
