ZDI-26-752: (0Day) Genesis World decompress_usdz Directory Traversal Remote Code Execution Vulnerability
ZDI disclosed an unpatched Genesis World decompress_usdz traversal RCE rated CVSS 7.8.
ZDI published ZDI-26-752, an unpatched remote code execution flaw in Genesis World’s decompress_usdz function involving directory traversal. Remote attackers can execute arbitrary code on affected installations, but interaction with the library is required. ZDI assigned CVSS 7.8. The advisory does not list a CVE or say the flaw is being exploited.
- Unpatched ZDI-26-752 affects Genesis World decompress_usdz.
- Directory traversal can lead to remote code execution.
- Library interaction is required; ZDI rates it CVSS 7.8.
- No CVE or in-the-wild exploitation is reported.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Genesis World. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 7.8.
This source does not provide full text. Read it at zerodayinitiative.com.