Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in install_archive_content() that allows attackers to write files… (CVE-2026-112049)

The vulnerability in Vita3K prior to build 4187 is a path traversal issue (CWE-22) within the install_archive_content() function. It arises from insufficient validation of zip entry names in .vpk archives, allowing crafted archives to escape the intended extraction directory by including '..' segments or absolute paths. This can result in arbitrary file writes to any location writable by the Vita3K process, potentially enabling host code execution. The CVSS 3.1 vector indicates local attack vector with low complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

Successful exploitation allows an attacker to write files outside the intended installation directory, potentially leading to arbitrary code execution on the host system. This compromises the integrity of the system where Vita3K is running. There is no reported impact on confidentiality or availability.

No official patch or remediation details are provided in the available data. Users should upgrade to build 4187 or later once available, as the vulnerability affects versions before build 4187. Until then, avoid opening untrusted .vpk archives with Vita3K. Monitor the vendor advisory for official fixes and updates.