PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-49290 byrongamatos CVE debrief

CVE-2026-49290 is a high-severity path-traversal vulnerability in Slopsmith, a self-contained web application for browsing, playing, and practicing Rocksmith 2014 Custom DLC (CDLC). The vulnerability allows an attacker to write arbitrary files outside the extraction directory by supplying a crafted PSARC or sloppak archive, potentially leading to arbitrary remote code execution on the host. The default Docker configuration runs as root, escalating the vulnerability's impact. Version 0.2.9-alpha.5 patches the issue. Defenders should exercise caution when handling archives from untrusted sources and limit exposure until updated.

Vendor
byrongamatos
Product
slopsmith
CVSS
HIGH 7.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-19
Original CVE updated
2026-06-23
Advisory published
2026-06-19
Advisory updated
2026-06-23

Who should care

Defenders managing Slopsmith instances, particularly those exposed to the public internet or running with elevated privileges (e.g., root), should prioritize patching to version 0.2.9-alpha.5. Docker users should pull the latest image once it's available. All users of Slopsmith should be cautious when handling PSARC or sloppak archives from untrusted sources.

Technical summary

The vulnerability exists in three archive extractors within Slopsmith: `lib/psarc.py::unpack_psarc` for PSARC TOC filenames, `lib/patcher.py::unpack_psarc` (a duplicate of the above in the patcher flow), and `lib/sloppak.py::_unpack_zip` using `ZipFile.extractall()` without a member filter. These extractors concatenate archive-entry filenames directly onto the extraction root without validation, allowing attackers to supply filenames containing `..` segments, absolute paths, or backslash separators. This enables path-traversal attacks, potentially leading to arbitrary file writes outside the extraction directory. In the default Docker configuration (running as root), this vulnerability can escalate to arbitrary remote code execution on the host.

Defensive priority

High priority due to potential for remote code execution in default Docker configurations.

Recommended defensive actions

  • Update Slopsmith to version 0.2.9-alpha.5 or later
  • Limit exposure of Slopsmith instances to the public internet
  • Exercise caution when handling PSARC or sloppak archives from untrusted sources
  • Pull the latest Docker image once it's available
  • Review and validate archive filenames before extraction

Evidence notes

The primary evidence for this vulnerability comes from the Slopsmith GitHub repository and the NVD CVE record. The vulnerability affects Slopsmith versions prior to 0.2.9-alpha.5. Defenders should verify the patched version and review archive extraction processes to ensure proper validation of filenames.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-49290 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-49290

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-49290 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-49290

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.