Slopsmith, a web application for Rocksmith 2014 Custom DLC, had a path traversal vulnerability in its archive extraction components prior to version 0.2.9-alpha.5. The vulnerability stems from three archive extractors concatenating archive entry filenames directly onto the extraction root without validating for traversal sequences like '..', absolute paths, or backslashes. Specifically, the functions lib/psarc.py::unpack_psarc, lib/patcher.py::unpack_psarc, and lib/sloppak.py::_unpack_zip are affected. The use of Python's zipfile.extractall() without member filtering allows crafted archives to write files outside the extraction directory. When running Slopsmith in Docker with root privileges and the ability to drop files into the plugin directory, this can escalate to arbitrary remote code execution on the host. Version 0.2.9-alpha.5 addresses this issue by patching the extraction logic.

An attacker can craft malicious PSARC or sloppak archives that exploit the path traversal vulnerability to write arbitrary files outside the intended extraction directory. In default Docker setups running as root, this can escalate to arbitrary remote code execution on the host system. This poses a high risk of system compromise if exploited.

The vulnerability is fixed in Slopsmith version 0.2.9-alpha.5. Users should upgrade to this version or later. Until upgrading, do not open PSARC or sloppak archives from untrusted sources and avoid exposing the Slopsmith instance to the public internet. Docker users should pull the latest Slopsmith Docker image once it is published. These steps will mitigate the risk of exploitation.