CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:H
AI Score
Confidence
Low
tgstation-server is vulnerable to Path Traversal. The vulnerability is due to low permission users with the “Set .dme Path” privilege potentially setting malicious .dme files to be compiled and executed, which can escalate into remote code execution via BYOND’s shell() proc.