Summary
Roblox Studio’s 3D Importer can automatically resolve, include, and upload an unrelated local image referenced by an FBX file.
If an FBX contains an external texture reference but the modeler does not include the original texture, another image on the recipient’s computer with the same filename can be used instead.
The user selects only the FBX file in Studio and does not separately select or explicitly authorize the unrelated local image for upload.
Although the texture may technically appear on the model preview, it can be distorted across the model’s UV mapping and impossible to recognize as a specific local image. The Importer does not display a separate undistorted preview, complete local path, or explicit per-texture upload confirmation.
This creates a privacy, safety, and account-moderation risk for creators importing FBX models received from other people.
Real incident and impact
This issue has already affected me personally.
A modeler sent me a completed FBX model for direct import into Roblox Studio.
Unknown to me, the FBX contained external texture references to an image named image (1).png. The modeler’s original image was not included with the FBX file.
Coincidentally, I already had an old and completely unrelated screenshot named image (1).png in my own Downloads directory.
I downloaded the FBX into my Downloads directory and selected only that FBX file in Roblox Studio’s 3D Importer. I did not select, inspect, or knowingly authorize my unrelated local screenshot for upload.
I did not open or inspect the FBX in Blender before importing it into Studio. At that time, I had no knowledge that the FBX contained external texture references or that it could cause another file from my Downloads directory to be uploaded.
The unintended texture was technically visible on the model in the Studio preview. However, it was distorted and distributed across the model’s UV mapping. It did not look like a recognizable screenshot and appeared only as unclear black and yellow shapes across the mesh.
I believed this appearance was caused by a missing texture, an incorrect material, or a rendering/preview bug.
The Importer did not show me:
- A separate and undistorted preview of the image.
- The filename
image (1).pngas a file that would be uploaded. - The complete local path to that image.
- A warning that the original referenced texture was missing.
- An explicit confirmation asking whether I wanted to upload that local image.
The Avatar Item subsequently failed technical validation several times. I retried the import while attempting to correct those validation errors.
All retries occurred during the same troubleshooting session and before I received any moderation notification or became aware that an unintended local image had been included. Because the FBX reference remained unchanged, the same unrelated local image could be included again during every retry.
This incident resulted in a permanent account-level moderation action.
The content of the unintended image, account information, asset identifiers, and moderation case details are intentionally omitted from this public report. I can provide those details privately to Roblox staff if required.
This post is not intended as a public moderation appeal. It documents a technical and safety issue in the FBX import process that can cause any creator to unknowingly upload an unrelated local file.
Steps that led to the issue
- A modeler exported an FBX containing external texture references to
image (1).png. - The modeler sent me the FBX without including the original referenced texture.
- I downloaded the FBX into my Downloads directory.
- My Downloads directory already contained an unrelated screenshot with the same filename,
image (1).png. - I opened Roblox Studio’s 3D Importer.
- I selected only the FBX file.
- Studio resolved the FBX texture references to the unrelated
image (1).pngstored in my Downloads directory. - The texture appeared distorted across the model’s UV mapping and was not recognizable as my local screenshot.
- Studio did not show a separate image preview, complete local path, or explicit per-texture upload confirmation.
- I completed the import under the assumption that the black and yellow appearance was a missing-texture or rendering issue.
- The Avatar Item failed technical validation, and I retried the import several times before receiving any moderation notification.
- The same unintended local image was included during those attempts.
Investigation after the incident
I discovered the external texture references only after the account had already been moderated.
After the incident, I downloaded the original FBX again directly from the modeler’s message. For the first time, I imported that FBX into Blender specifically to investigate what had happened.
I then inspected the imported image datablocks through Blender’s Python console.
The imported FBX produced three separate image datablocks:
image (1).pngimage (1).png.001image (1).png.002
I used the following command to display their resolved paths:
print("\n".join(
f"{img.name} -> {bpy.path.abspath(img.filepath)}"
for img in bpy.data.images
))
The result showed that all three datablocks resolved to the same unrelated local file:
image (1).png -> C:\Users\<WindowsUser>\Downloads\image (1).png
image (1).png.001 -> C:\Users\<WindowsUser>\Downloads\image (1).png
image (1).png.002 -> C:\Users\<WindowsUser>\Downloads\image (1).png
I then checked whether the imported images were packed or external:
for img in bpy.data.images:
if img.source == "FILE":
print(
img.name,
"PACKED" if img.packed_file else "EXTERNAL",
bpy.path.abspath(img.filepath)
)
The output confirmed that all three datablocks were marked EXTERNAL:
image (1).png EXTERNAL C:\Users\<WindowsUser>\Downloads\image (1).png
image (1).png.001 EXTERNAL C:\Users\<WindowsUser>\Downloads\image (1).png
image (1).png.002 EXTERNAL C:\Users\<WindowsUser>\Downloads\image (1).png
This Blender investigation was performed only after the moderation action. I did not use Blender or know about these texture references before the original Studio imports.
Actual behavior
Studio resolved the FBX’s missing external texture reference to an unrelated same-named image in the local Downloads directory.
The unrelated local image was uploaded with the model even though the user selected only the FBX.
The only visual indication was the image distorted across the model’s UV mapping. It was not identifiable as the original screenshot.
The Importer did not clearly disclose:
- The complete resolved path of the local image.
- That the image came from an external FBX reference.
- That the modeler’s original texture was missing.
- That multiple texture references resolved to the same local file.
- That this specific local file would be uploaded.
- That validation retries could include the same image again.
Expected behavior
Before uploading any externally referenced texture, the 3D Importer should:
- Display a separate and undistorted preview of every image.
- Display the complete resolved local path.
- Clearly identify externally referenced textures.
- Warn when an original referenced texture is missing.
- Warn when multiple references resolve to the same local image.
- Require explicit confirmation for every texture upload.
- Allow individual textures to be excluded.
- Provide an “Import without textures” option.
- Require confirmation again before a failed validation retry uploads the same texture.
A texture displayed only through distorted UV mapping should not be treated as sufficient confirmation that the creator knowingly selected that local image.
Reproduction frequency
The same unintended local image was included during multiple import attempts in the same troubleshooting session.
System information
- Operating system: Windows 11
- Imported model format: FBX
- Import workflow: 3D Importer
Supporting evidence
I can provide Roblox staff with:
- The original FBX received from the modeler.
- A continuous recording showing the original FBX being downloaded directly from the modeler’s message and investigated.
- A censored Blender console screenshot showing the imported external image datablocks and resolved paths.
- Relevant import and upload timestamps.
- The private moderation reference and account-level impact.
I will not post the unintended image or sensitive moderation information publicly.
