CVE-2026-49290

Name of the Vulnerable Software and Affected Versions Slopsmith versions prior to 0.2.9-alpha.5

Description Slopsmith is a web application for browsing, playing, and practicing Rocksmith 2014 Custom DLC. A path-traversal issue in the archive extractors allows an attacker to write arbitrary files outside the extraction directory by providing a crafted PSARC or sloppak archive. This occurs because three archive extractors concatenate archive-entry filenames directly onto the extraction root without validation: the unpack psarc function in lib/psarc.py, the unpack psarc function in lib/patcher.py, and the unpack zip function in lib/sloppak.py, which uses ZipFile.extractall() without a member filter. These functions accept entry names containing absolute paths, backslash separators, or .. segments. In default Docker configurations where the application runs as root, the ability to drop a file into the plugin directory can lead to arbitrary remote code execution on the host.

Recommendations Update to version 0.2.9-alpha.5. Avoid opening PSARC or sloppak archives from untrusted sources. Do not expose the Slopsmith instance to the public internet. Docker users should pull the latest image once the updated version is published.