CVE-2026-129477

CVSS 6.8 (medium) · published 2026-11-15

Assimp through 6.0.6 contains a path traversal vulnerability in the glTF and glTF2 importers that allows attackers to read local files via crafted buffers[].uri values. Attackers can supply glTF models with '..' segments or absolute paths in buffer URIs to load files like /etc/passwd into imported mesh vertex data.

Weakness: CWE-22

Source: NVD CVE-2026-129477

References

• https://github.com/assimp/assimp/blob/v6.0.6/code/AssetLib/glTF2/glTF2Asset.inl#L608-L612
• https://github.com/assimp/assimp/issues/6933
• https://github.com/assimp/assimp/pull/7027
• https://www.vulncheck.com/advisories/assimp-through-6.0.6-path-traversal-via-gltf-external-buffer-uris

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.