CVE-2026-112049

MEDIUM 5.5

Vita3K before build 4187 Path Traversal via VPK Package Installation

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in install_archive_content() that allows attackers to write files outside the install directory via crafted .vpk archives. Attackers can embed '..' segments or absolute paths in zip entry names to write attacker-controlled files anywhere writable by Vita3K, potentially enabling host code execution.

CWE	CWE-22
Vendor	vita3k
Product	vita3k
Published	Oct 18, 2026

Stay Ahead of the Next One

Get instant alerts for vita3k vita3k

Be the first to know when new medium vulnerabilities affecting vita3k vita3k are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

Vita3K / Vita3K

0 < 4187

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Vita3K/Vita3K/issues/4254 github.com: https://github.com/Vita3K/Vita3K/commit/55f88cd17a78ce8af7d753c7c4eb2f709f7d6dbc github.com: https://github.com/Vita3K/Vita3K/blob/f0273e4cd9b860ea77c44c73d9f5c5b1ed5fa8ab/vita3k/interface.cpp#L219-L234 vulncheck.com: https://www.vulncheck.com/advisories/vita3k-before-build-4187-path-traversal-via-vpk-package-installation

Credits

George Chen