Live › vulnerability › CVE-2026-112049
Go to dashboardVita3K, a PS Vita emulator, fails to block '..' segments and absolute paths in zip entry names when installing a .vpk archive. A malicious archive can write attacker-chosen files to any location Vita3K can write to, which may lead to code execution on the host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only people who run Vita3K and install .vpk packages, which are PS Vita package archives. Someone who never installs .vpk files from outside sources is unlikely to be exposed, and the sources do not say whether a server or CI system could be reached this way.
No product ranges from the sources yet.
4187 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in install_archive_content() that allows attackers to write files outside the install directory via crafted .vpk archives. Attackers can embed '..' segments or absolute paths in zip entry names to write attacker-controlled files anywhere writable by Vita3K, potentially enabling host code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-112049")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.