Path Traversal Vulnerability in Slopsmith Web Application

CVE-2026-49290

What is CVE-2026-49290?

Slopsmith, a web application for managing Rocksmith 2014 Custom DLC, is susceptible to a path traversal vulnerability that allows attackers to write arbitrary files outside the designated extraction directory. This issue arises from improper handling of filenames in three archive extractors, specifically through the lib/psarc.py and lib/patcher.py scripts, along with the zipfile module's extractall function that fails to validate entry names correctly. When exploited, this vulnerability can lead to remote code execution, especially when the application is deployed with default Docker configurations that run as root. Users are strongly advised to avoid opening unsecured PSARC or sloppak archives and to restrict public access to Slopsmith until an update is applied.

References