Path Traversal Vulnerability in Assimp Product by Asset Import Library

CVE-2026-129477

What is CVE-2026-129477?

Assimp, a widely-used asset import library, is exposed to a path traversal vulnerability through its glTF and glTF2 importers. This security flaw allows a malicious actor to craft glTF models containing specific URI values that leverage '..' segments or absolute paths. By exploiting this vulnerability, attackers can manipulate the import process to read sensitive local files such as /etc/passwd, potentially exposing critical system information. The issue highlights the importance of secure handling of file paths in data processing applications.

References