CVE-2026-112049
Vita3K before build 4187 Path Traversal via VPK Package Installation
Vita3K Vita3K
CVSS
6.7MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 3% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 4187Vita3KCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in install_archive_content() that allows attackers to write files outside the install directory via crafted .vpk archives. Attackers can embed '..' segments or absolute paths in zip entry names to write attacker-controlled files anywhere writable by Vita3K, potentially enabling host code execution.
Text from CVE List
Affected versions 1
- Vita3Kaffected: all versions before 4187CVE List
References 4
- github.com/Vita3K/Vita3K/commit/55f88cd17a78ce8af7d753c7c4eb2f709f7d6dbcFixvia CVE List
- vulncheck.com/advisories/vita3k-before-build-4187-path-traversal-via-vpk-package-installationAdvisoryvia CVE List
- github.com/Vita3K/Vita3K/issues/4254Referencevia CVE List
- github.com/Vita3K/Vita3K/blob/f0273e4cd9b860ea77c44c73d9f5c5b1ed5fa8ab/vita3k/interface.cpp#L219-L234Referencevia CVE List