ZDI-26-755: (0Day) Genesis World glTF Server-Side Request Forgery Vulnerability
ZDI disclosed an unpatched Genesis World glTF SSRF flaw rated CVSS 6.1.
ZDI published ZDI-26-755, an unpatched server-side request forgery flaw in Genesis World’s glTF handling. Remote attackers can initiate arbitrary server-side requests, but interaction with the library is required and attack vectors depend on the implementation. ZDI assigned CVSS 6.1. The advisory does not cite a CVE or observed exploitation.
- Unpatched ZDI-26-755 affects Genesis World glTF handling.
- Remote attackers can trigger arbitrary server-side requests.
- Exploitation requires interaction with the library; CVSS 6.1.
- No CVE or confirmed in-the-wild exploitation is stated.
This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Genesis World. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 6.1.
This source does not provide full text. Read it at zerodayinitiative.com.