CVE-2026-49290: Slopsmith Path Traversal Vulnerability

CVE-2026-49290 Overview

CVE-2026-49290 is a path traversal vulnerability [CWE-22] in Slopsmith, a self-contained web application for browsing, playing, and practicing Rocksmith 2014 Custom DLC (CDLC). Versions prior to 0.2.9-alpha.5 fail to validate archive entry names during extraction of PSARC and sloppak archives. An attacker who supplies a crafted archive can write arbitrary files outside the extraction directory. Under the default Docker configuration, which runs the container as root, the bug escalates to arbitrary remote code execution on the host by dropping a file into the plugin directory.

Critical Impact
Crafted PSARC or sloppak archives enable arbitrary file write and, under default Docker deployments, full remote code execution as root.

Affected Products

Slopsmith versions prior to 0.2.9-alpha.5
Slopsmith Docker images built from affected versions
Deployments processing untrusted PSARC or sloppak archives

Discovery Timeline

2026-06-19 - CVE-2026-49290 published to the National Vulnerability Database (NVD)
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-49290

Vulnerability Analysis

Three archive extractors in Slopsmith concatenate archive-entry filenames directly onto the extraction root without validation. The affected functions are lib/psarc.py::unpack_psarc, which processes PSARC table-of-contents filenames, lib/patcher.py::unpack_psarc, which duplicates the PSARC logic in the patcher flow, and lib/sloppak.py::_unpack_zip, which calls Python's ZipFile.extractall() with no member filter.

Each extractor accepts entry names containing .. segments, absolute paths, or backslash separators. The Python zipfile module's default extractall() is documented as not preventing traversal when callers do not supply a member-filter callback. An attacker can therefore place files anywhere the Slopsmith process has write permission.

When Slopsmith runs in the default Docker container as root, the impact extends to arbitrary code execution. Dropping a Python file into the plugin directory causes the application to load and execute attacker-controlled code on the host.

Root Cause

The root cause is missing input validation on archive entry names before path concatenation. Neither the PSARC parser nor the sloppak ZIP handler canonicalizes paths or rejects traversal sequences. The default ZipFile.extractall() call relies on caller-supplied filters, which were absent.

Attack Vector

An attacker crafts a malicious PSARC or sloppak archive with entries such as ../../plugins/evil.py or absolute paths. A user opens the archive in Slopsmith, or an attacker with access to the application interface submits it directly. Extraction writes the file outside the intended directory, and the plugin loader executes any code placed in the plugin path.

The vulnerability is exploitable over the network when Slopsmith is exposed publicly, and locally through any workflow that accepts untrusted archives.

Detection Methods for CVE-2026-49290

Indicators of Compromise

Unexpected files appearing outside the configured Slopsmith extraction directory after PSARC or sloppak archive imports.
New or modified files in the Slopsmith plugin directory that were not deployed by an administrator.
Archive entries containing .., absolute paths, or backslash separators recorded in application logs.
Outbound network connections initiated by the Slopsmith process to unknown hosts following archive processing.

Detection Strategies

Inspect PSARC and sloppak archives prior to import using a tool that lists entry names and flags traversal sequences.
Monitor file integrity on the Slopsmith plugin directory and adjacent application paths.
Audit Docker container filesystems for files written outside expected mount points by the Slopsmith user.

Monitoring Recommendations

Log all archive uploads and extractions performed by Slopsmith, including entry counts and target paths.
Alert on process executions spawned by the Slopsmith service that are not part of its normal runtime profile.
Track network exposure of Slopsmith instances and alert when the service binds to a public interface.

How to Mitigate CVE-2026-49290

Immediate Actions Required

Upgrade Slopsmith to version 0.2.9-alpha.5 or later, which patches the three vulnerable extractors.
Remove any Slopsmith instance from public network exposure until patched.
Do not open PSARC or sloppak archives sourced from untrusted or unknown origins.
Pull the latest Slopsmith Docker image once published and redeploy affected containers.

Patch Information

Version 0.2.9-alpha.5 contains the fix. The patch is published in the upstream repository commit 9cccac12a. See the GitHub Security Advisory GHSA-8wr9-348x-xwmr and the upstream commit for implementation details. An archived repository snapshot is also available.

Workarounds

Restrict Slopsmith network access to trusted local users only, behind a firewall or VPN.
Run the Slopsmith Docker container as a non-root user with a read-only filesystem and limited write mounts.
Validate archives out-of-band by listing entries and rejecting any containing .., absolute paths, or backslash separators before importing.
Disable archive imports entirely until the patched version is deployed.

bash

# Configuration example: run Slopsmith container as non-root with limited writes
docker run \
  --user 1000:1000 \
  --read-only \
  --tmpfs /tmp \
  -v /srv/slopsmith/data:/data \
  --network host_internal \
  slopsmith:0.2.9-alpha.5