CVE-2004-2594: Id Software Quake Ii Server Windows

Medium severity, CVSS 5.0. EPSS: 1.8% chance of exploitation in the next 30 days.

Absolute path traversal vulnerability in Quake II server before R1Q2 on Windows, as used in multiple products, allows remote attackers to read arbitrary files via a "\/" in a pathname argument, as demonstrated by "download \/server.cfg".

Affected products

• Id Software Quake Ii Server Windows: version 3.20 only; version 3.21 only

Published 2004-12-31. Last modified 2026-06-16.