CVE-2004-1958: Epic Games Unreal Engine

Medium severity, CVSS 5.0. EPSS: 2.4% chance of exploitation in the next 30 days.

Directory traversal vulnerability in manifest.ini in Unreal engine allows remote attackers to overwrite arbitrary files via .. (dot dot) sequences in a UMOD (Unreal MOD) file.

Affected products

• Epic Games Unreal Engine: version 433 only; version 436 only
• Epic Games Unreal Tournament: version 451b only
• Epic Games Unreal Tournament 2003: version 2199_macos only; version 2199_win32 only; version 2225_macos only; version 2225_win32 only

Published 2004-12-31. Last modified 2026-06-16.