CVE-2022-3008

The tinygltf library uses the C library function wordexp() to perform file path expansion on untrusted paths that are provided from the input file. This function allows for command injection by using backticks. An attacker could craft an untrusted path input that would result in a path expansion. We recommend upgrading to 2.6.0 or past commit 52ff00a38447f06a17eab1caa2cf0730a119c751

• CWE-78
• CWE-77

• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49053Exploit, Issue Tracking, Mailing List, Third Party Advisory
• https://github.com/syoyo/tinygltf/blob/master/README.mdProduct, Third Party Advisory
• https://github.com/syoyo/tinygltf/commit/52ff00a38447f06a17eab1caa2cf0730a119c751Patch, Third Party Advisory
• https://github.com/syoyo/tinygltf/issues/368Exploit, Issue Tracking, Patch, Third Party Advisory
• https://www.debian.org/security/2022/dsa-5232Third Party Advisory
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49053Exploit, Issue Tracking, Mailing List, Third Party Advisory
• https://github.com/syoyo/tinygltf/blob/master/README.mdProduct, Third Party Advisory
• https://github.com/syoyo/tinygltf/commit/52ff00a38447f06a17eab1caa2cf0730a119c751Patch, Third Party Advisory
• https://github.com/syoyo/tinygltf/issues/368Exploit, Issue Tracking, Patch, Third Party Advisory
• https://www.debian.org/security/2022/dsa-5232Third Party Advisory

Published

Sep 5, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-30072WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) v…5.4
• CVE-2022-30073WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) v…5.4
• CVE-2022-30075In TP-Link Router AX50 firmware 210730 and older, import of …8.8
• CVE-2022-30076ENTAB ERP 1.0 allows attackers to discover users' full names…5.3
• CVE-2022-30078NETGEAR R6200_V2 firmware versions through R6200v2-V1.0.3.12…8.8
• CVE-2022-30079Command injection vulnerability was discovered in Netgear R6…8.8
• CVE-2022-30083EllieGrid Android Application version 3.4.1 is vulnerable to…9.8
• CVE-2022-3010The Priva TopControl Suite contains predictable credentials …7.5
• CVE-2022-30105In Belkin N300 Firmware 1.00.08, the script located at /sett…9.8
• CVE-2022-30110The file preview functionality in Jirafeau < 4.4.0, which is…6.1
• CVE-2022-30111Due to the use of an insecure algorithm for rolling codes in…6.8
• CVE-2022-30113Electronic mall system 1.0_build20200203 is affected vulnera…9.8