CVE-2000-0303: Quake3 Arena allows malicious server operators to read or modify files on a client via a dot dot (..) attack.

Security readout for executives and security teams

CVE-2000-0303 is an old Quake3 Arena client risk. A malicious game server operator could abuse the auto-download handling to read or modify files on a connecting client using directory traversal. Business impact is mainly for environments that still allow this legacy game or preserve old workstations/images. Exposure is likely limited to Quake3 Arena clients that connect to untrusted or malicious servers, especially if auto-download is enabled. Modern enterprise exposure should be rare unless legacy gaming systems, labs, archives, or unmanaged endpoints still run the client. Treat this as a legacy exposure cleanup item unless Quake3 Arena is still used. Prioritize removal or isolation of affected clients over emergency response, because the bundle provides no current exploitation evidence or severity score. Mitigation focus: Inventory endpoints for Quake3 Arena installations or preserved legacy images.; Remove the client where there is no approved business need.; Avoid connecting legacy clients to untrusted game servers..

Prepared

Jul 12, 2026, 04:18 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.