{"id":"CVE-2026-112049","kind":"vulnerability","aliases":["CVE-2026-112049"],"related":[],"title":"Vita3K: crafted .vpk archives write files outside the install directory","description":"Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in install_archive_content() that allows attackers to write files outside the install directory via crafted .vpk archives. Attackers can embed '..' segments or absolute paths in zip entry names to write attacker-controlled files anywhere writable by Vita3K, potentially enabling host code execution.","summary":"Vita3K, a PS Vita emulator, fails to block '..' segments and absolute paths in zip entry names when installing a .vpk archive. A malicious archive can write attacker-chosen files to any location Vita3K can write to, which may lead to code execution on the host.","severity":"medium","cvss":6.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","emulator","other","vita3k"],"not_affected_if":["build-4187-or-later","no-vpk-installs"],"how_to_check":"- Check the Vita3K build number: unknown how to query it from the sources; compare against build 4187\n- Look at whether the user installs .vpk files from untrusted sources","fix":"- Update Vita3K to build `4187` or later\n- Install .vpk archives only from sources you trust until updated","status":"open","published_at":"2026-10-18T13:16:36+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T03:46:45+00:00","updated_at":"2026-10-25T03:46:45+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:46:45Z","model":"claude-haiku-5-5","output":{"fix":"- Update Vita3K to build `4187` or later\n- Install .vpk archives only from sources you trust until updated","reach":"local","title":"Vita3K: crafted .vpk archives write files outside the install directory","impact":"high","summary":"Vita3K, a PS Vita emulator, fails to block '..' segments and absolute paths in zip entry names when installing a .vpk archive. A malicious archive can write attacker-chosen files to any location Vita3K can write to, which may lead to code execution on the host.","category":"other","nicknames":[],"who_cares":["vita3k","desktop","emulator"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker writes arbitrary files on the host, possibly running code","analyst_note":"","how_to_check":"- Check the Vita3K build number: unknown how to query it from the sources; compare against build 4187\n- Look at whether the user installs .vpk files from untrusted sources","needs_analyst":false,"not_affected_if":["build-4187-or-later","no-vpk-installs"],"who_is_affected":"Only people who run Vita3K and install .vpk packages, which are PS Vita package archives. Someone who never installs .vpk files from outside sources is unlikely to be exposed, and the sources do not say whether a server or CI system could be reached this way.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000579,"input_tokens":3342,"output_tokens":490,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112049':13A,16A '-2026':12A,15A '4187':70C 'absolut':31B,101C 'allow':83C 'anywher':113C 'archiv':4A,41B,44B,80C,95C 'attack':48B,84C,96C,110C 'attacker-chosen':47B 'attacker-control':109C 'block':28B 'build':69C 'chosen':49B 'code':62B,120C 'contain':71C 'content':81C 'control':111C 'craft':2A,93C 'cve':11A,14A 'desktop':17B 'directori':10A,91C 'emb':98C 'emul':18B,25B 'enabl':118C 'entri':35B,105C 'execut':63B,121C 'fail':26B 'file':6A,50B,87C,112C 'host':66B,119C 'instal':9A,38B,79C,90C 'lead':60B 'locat':53B 'malici':43B 'may':59B 'name':36B,106C 'outsid':7A,88C 'path':32B,73C,102C 'potenti':117C 'ps':23B 'segment':29B,99C 'slip':76C 'travers':74C 'via':92C 'vita':24B 'vita3k':1A,20B,21B,54B,67C,116C 'vpk':3A,40B,94C 'vulner':77C 'writabl':114C 'write':5A,46B,56B,86C,108C 'zip':34B,75C,104C","nicknames":[],"mitigations":[],"who_affected":"Only people who run Vita3K and install .vpk packages, which are PS Vita package archives. Someone who never installs .vpk files from outside sources is unlikely to be exposed, and the sources do not say whether a server or CI system could be reached this way.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T13:16:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112049","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112049","severity":null,"published_at":"2026-10-18T13:16:36+00:00","modified_at":"2026-10-22T03:16:34+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}