CVE-2011-2764: IOQUAKE3 Engine

High severity, CVSS 10.0. EPSS: 8.7% chance of exploitation in the next 30 days.

The FS_CheckFilenameIsNotExecutable function in qcommon/files.c in the ioQuake3 engine 1.36 and earlier, as used in World of Padman, Smokin' Guns, OpenArena, Tremulous, and ioUrbanTerror, does not properly determine dangerous file extensions, which allows remote attackers to execute arbitrary code via a crafted third-party addon that creates a Trojan horse DLL file.

Affected products

• IOQUAKE3 IOQUAKE3 Engine: up to and including 1.36; version 1.36 only
• Openarena Openarena: any version
• Smokin-Guns Smokin' Guns: any version
• Tremulous Tremulous: any version
• Urbanterror Iourbanterror: any version
• Worldofpadman World Of Padman: any version

Published 2011-08-04. Last modified 2026-06-16.