Path Traversal Vulnerability in Vita3K Affected by Crafted VPK Archives
CVE-2026-112049

6.7MEDIUM

Key Information:

Vendor

Vita3k

Status
Vita3k
Vendor
CVE Published:
18 October 2026

What is CVE-2026-112049?

Vita3K prior to build 4187 contains a path traversal vulnerability in the install_archive_content() function. This flaw enables attackers to manipulate crafted .vpk archive files to write files outside the intended install directory by embedding '..' segments or absolute paths in zip entry names. As a result, malicious actors may exploit this vulnerability to write files in any location that is writable by Vita3K, potentially leading to unauthorized execution of host code.

Affected Version(s)

Vita3K 0 < 4187

References

https://github.com/Vita3K/Vita3K/issues/4254
issue-tracking
https://github.com/Vita3K/Vita3K/commit/55f88cd17a78ce8af...
patch
https://github.com/Vita3K/Vita3K/blob/f0273e4cd9b860ea77c...
technical-description

CVSS V4

Score:
6.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.