Directory traversal vulnerability in Quake 3 engine as used in products including Quake3 Arena Return to Castle Wolfenstein Wolfenstein: Enemy Territory and Star Trek Voyager: Elite Force when the sv_allowdownload cvar is enabled allows remote attackers to read arbitrary files from the server via \..\ sequences in a .pk3 file request.