CVE-2026-112049 in Vita3K
Summary
by MITRE • 10/18/2026
Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in install_archive_content() that allows attackers to write files outside the install directory via crafted .vpk archives. Attackers can embed '..' segments or absolute paths in zip entry names to write attacker-controlled files anywhere writable by Vita3K, potentially enabling host code execution.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability identified in Vita3K prior to build 4187 represents a critical security flaw rooted in improper handling of archive extraction operations within the install_archive_content function. This specific weakness is classified as a path traversal or zip slip vulnerability, which occurs when an application fails to validate and sanitize file paths contained within compressed archives before extracting them to the local filesystem. In this context, Vita3K processes .vpk files, which are proprietary PlayStation Portable archive formats used for game distribution. The emulator's extraction logic does not adequately verify that the destination path of each entry remains strictly confined within the designated installation directory. This lack of boundary enforcement allows malicious actors to manipulate the internal structure of a crafted .vpk file by embedding relative path traversal sequences such as double dots followed by forward slashes or absolute paths in the zip entry names. When the emulator processes these entries, it interprets them literally and writes the extracted content to locations specified by the attacker rather than within the intended sandboxed directory.
From a technical perspective, this flaw exploits the fundamental assumption that archive contents are always relative to the extraction root. By injecting sequences like .. or absolute paths such as /tmp/malicious_payload.exe, an adversary can bypass the expected directory structure and write files to arbitrary locations on the host system where Vita3K has read-write permissions. This capability transforms a simple file storage operation into a mechanism for unauthorized filesystem modification. The severity of this issue is amplified by the fact that emulators often run with elevated privileges or have broad access to user directories, making successful exploitation highly likely to result in significant compromise. If an attacker can write executable binaries or scripts to locations where they are subsequently executed, either through direct execution or via other application features like plugin loading or configuration file parsing, the impact escalates from mere data corruption to full remote code execution on the host machine.
The operational impact of this vulnerability is severe, as it directly undermines the integrity and confidentiality of the host system. An attacker who distributes a malicious .vpk archive can trick an unsuspecting user into installing it through Vita3K's interface. Once installed, the payload extracted via the path traversal flaw could establish persistence mechanisms, install backdoors, or exfiltrate sensitive data from accessible directories. This scenario aligns with common attack patterns observed in real-world malware distribution campaigns where malicious archives are disguised as legitimate software updates or game patches. The ability to write files anywhere writable by Vita3K means that even if the emulator restricts access to certain system-critical areas, it can still compromise user-specific data and application configurations, leading to potential account takeover or further lateral movement within a networked environment.
To mitigate this risk, users must immediately upgrade Vita3K to build 4187 or any subsequent version where the path traversal issue has been patched by implementing strict validation of archive entry paths during extraction. Developers should enforce canonicalization of file paths and verify that the resolved destination path starts with the expected installation directory prefix before writing any data. Additionally, employing a whitelist approach for allowed characters in filenames and rejecting entries containing relative navigation sequences can prevent exploitation attempts. From an operational security standpoint, users should exercise caution when installing content from untrusted sources and ensure their emulator software is kept up to date with the latest security fixes. This vulnerability maps directly to CWE-22 Improper Limitation of a Pathname to a Restricted Directory in the Common Weakness Enumeration standard and corresponds to techniques associated with ATT&CK tactic TA0004 Impact, specifically file manipulation or persistence mechanisms that rely on unauthorized filesystem access.