CVE-2021-27030: Autodesk FBX Review ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability
A user may be tricked into opening a malicious FBX file which may exploit a Directory Traversal Remote Code Execution vulnerability in FBX’s Review causing it to run arbitrary code on the system.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autodesk FBX Review. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ZIP files. When handling filenames specified within a ZIP file, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-27030?
CVE-2021-27030 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2021-27030?
To mitigate CVE-2021-27030, users should update Autodesk FBX Review to the latest version beyond 1.5.0.
What type of vulnerability is CVE-2021-27030?
CVE-2021-27030 is a Directory Traversal vulnerability that can lead to Remote Code Execution.
Who is affected by CVE-2021-27030?
CVE-2021-27030 affects users of Autodesk FBX Review version 1.5.0 and earlier.
What are the potential consequences of CVE-2021-27030?
Exploitation of CVE-2021-27030 may allow attackers to execute arbitrary code on the compromised system.