CVE-2020-14939
HIGHFreedroidRPG 1.0rc2 - Remote Code Execution via Modified Saved Game File
Title source: llmDescription
An issue was discovered in savestruct_internal.c in FreedroidRPG 1.0rc2. Saved game files are composed of Lua scripts that recover a game's state. A file can be modified to put any Lua code inside, leading to arbitrary code execution while loading.
References (2)
Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://logicaltrust.net/blog/2020/02/freedroid.html
Exploit, Issue Tracking, Vendor Advisory x_refsource_misc
https://bugs.freedroid.org/b/issue953
Scores
CVSS v3
7.8
EPSS
0.0131
EPSS Percentile
67.1%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-20
Status
published
Products (1)
freedroid/freedroidrpg
1.0 rc2
Published
Jun 23, 2020
Tracked Since
Feb 18, 2026