CVE-2026-112049: Vita3K before build 4187 Path Traversal via VPK Package Installation
Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in installarchivecontent() that allows attackers to write files outside the install directory via crafted .vpk archives. Attackers can embed '..' segments or absolute paths in zip entry names to write attacker-controlled files anywhere writable by Vita3K, potentially enabling host code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vita3Kto a version that resolves this vulnerability.Fixed in 4187
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker must persuade a user to install a crafted .vpk archive. The archive contains ZIP entry names with '..' path segments or absolute paths, causing files to be written outside Vita3K's intended installation directory.
Which installations are affected?
Vita3K builds before 4187 are affected. The issue is in the VPK package installation path, so exposure occurs when the application installs an attacker-controlled .vpk archive.
What is the practical impact of a successful exploit?
A crafted archive can write attacker-controlled files to locations writable by Vita3K rather than only to the package install directory. This may enable host code execution depending on where files can be written and how those files are later used.
What should teams do if they cannot immediately update?
Do not install .vpk archives from untrusted sources. Restrict Vita3K to a low-privilege account and avoid granting it write access to sensitive host locations.