CVE-2011-1412: IOQUAKE3 Engine

High severity, CVSS 7.5. EPSS: 4.2% chance of exploitation in the next 30 days.

sys/sys_unix.c in the ioQuake3 engine on Unix and Linux, as used in World of Padman 1.5.x before 1.5.1.1 and OpenArena 0.8.x-15 and 0.8.x-16, allows remote game servers to execute arbitrary commands via shell metacharacters in a long fs_game variable.

Affected products

• IOQUAKE3 IOQUAKE3 Engine: any version
• Openarena Openarena: version 0.8.x-15 only; version 0.8.x-16 only
• Worldofpadman World Of Padman: version 1.5 only

Published 2011-08-04. Last modified 2026-06-16.