CVE-2026-112049 Vita3K before build 4187 Path Traversal via VPK Package Installation
Attackers can achieve host code execution by installing crafted VPK archives containing path traversal sequences in Vita3K.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-112049?
CVE-2026-112049 is a medium-severity path traversal vulnerability in Vita3K, published on 18 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in install_archive_content() that allows attackers to write files outside the install directory via crafted .vpk archives. Attackers can embed '..' segments or absolute paths in zip entry names to write attacker-controlled files anywhere writable by Vita3K, potentially enabling host code execution.
Weakness: CWE-22
Which versions are affected by CVE-2026-112049?
How do I fix CVE-2026-112049?
No fix has been published for CVE-2026-112049 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-112049 being exploited?
There is no known exploitation of CVE-2026-112049 in the wild and no public exploit code.
Sources
Also known as GHSA-hxj8-qwr3-jc5p.