CVE-2026-52349: Menyoo 2.0 Path Traversal Vulnerability

CVE-2026-52349 Overview

CVE-2026-52349 is a directory traversal vulnerability [CWE-22] affecting Menyoo 2.0 (MenyooSP) versions prior to commit 729aa48. The flaw resides in multiple file management routines that accept user-supplied filenames without sanitization. Affected functionality includes the Spooner file manager, VehicleSpawner save/folder/rename operations, WeaponOptions save/folder/rename operations, and PedComponentChanger create folder, create file, and rename operations. A local attacker can supply crafted input containing path traversal sequences to write files outside the intended directory, resulting in arbitrary code execution in the context of the host process.

Critical Impact
Local attackers can escape the intended file storage directory and write arbitrary files, enabling code execution with the privileges of the running application.

Affected Products

MenyooSP (Menyoo 2.0) versions prior to commit 729aa48
All Spooner, VehicleSpawner, WeaponOptions, and PedComponentChanger file operations in vulnerable builds
Downstream forks that inherit the unpatched file-handling logic

Discovery Timeline

2026-07-20 - CVE-2026-52349 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-52349

Vulnerability Analysis

The vulnerability stems from concatenating user input into file paths without validating that the input remains within the intended directory. Multiple submenus in MenyooSP accept a filename via Game::InputBox and append it directly to a base directory string before creating, renaming, or saving files. Because the code performs no character filtering, attackers can inject path separators (\, /) and traversal sequences (..\) to redirect file operations. The result is arbitrary file write outside the sandboxed content folder, which enables code execution when the attacker overwrites executable, script, or configuration files loaded by the host process.

Root Cause

The root cause is missing input validation on filename parameters passed to file creation and rename routines. The pre-patch code paths in PedComponentChanger.cpp, VehicleSpawner.cpp, WeaponOptions.cpp, and the Spooner file manager construct paths with the pattern dir + "\\" + inputStr + ".xml". No canonicalization or allowlist check ensures inputStr contains only safe characters.

Attack Vector

Exploitation requires local access and low privileges. An attacker interacting with the in-game menu supplies a filename containing traversal characters, causing the target file to be created outside the expected directory. Writing to an auto-loaded script or configuration path yields arbitrary code execution.

cpp

// Patch from PedComponentChanger.cpp introducing IsSafePath validation
std::string inputStr = Game::InputBox("", 28U, "FMMC_KEY_TIP9");
if (inputStr.length() > 0)
{
-    ComponentChangerOutfit::Create(g_Ped1, dir + "\\" + inputStr + ".xml");
-    Game::Print::PrintBottomLeft("File ~b~created~s~.");
+    if (!IsSafePath(inputStr))
+    {
+        Game::Print::PrintBottomCentre("~r~Error:~s~ Invalid characters in name.");
+    }
+    else
+    {
+        ComponentChangerOutfit::Create(g_Ped1, dir + "\\" + inputStr + ".xml");
+        Game::Print::PrintBottomLeft("File ~b~created~s~.");
+    }
}
else Game::Print::PrintErrorInvalidInput(inputStr);
// Source: https://github.com/itsjustcurtis/MenyooSP/commit/729aa48

Detection Methods for CVE-2026-52349

Indicators of Compromise

Files with .xml or other extensions created outside the MenyooSP content directories (for example, under Menyoo\mpVehicles, Menyoo\Outfits, or Menyoo\Weapons)
File creation events where the resolved path contains ..\ or absolute path prefixes originating from the game process
Unexpected write operations by the host game process to system-writable directories such as %APPDATA%, Startup, or ScriptHook loader paths

Detection Strategies

Monitor process file-write telemetry for the host game binary and flag paths that escape the Menyoo installation root.
Audit filenames stored in Menyoo user data directories for traversal sequences or embedded path separators.
Compare installed MenyooSP builds against commit 729aa48 to identify vulnerable versions still in use.

Monitoring Recommendations

Enable file integrity monitoring on directories loaded automatically by the game or its script loaders.
Alert on newly created executables, DLLs, or .asi scripts in user-writable game folders.
Log invocations of the vulnerable submenus and correlate them with subsequent filesystem changes.

How to Mitigate CVE-2026-52349

Immediate Actions Required

Update MenyooSP to a build that includes commit 729aa48 or later.
Remove untrusted MenyooSP binaries from workstations and reinstall from the upstream repository.
Review the Menyoo content directories for files created with suspicious names and remove them.

Patch Information

The upstream project addressed the vulnerability by introducing an IsSafePath validation helper and applying it before every file creation, rename, or folder operation in the affected submenus. Refer to the GitHub Commit Details and the GitHub Pull Request Discussion for the full change set.

Workarounds

Avoid using the Spooner, VehicleSpawner, WeaponOptions, and PedComponentChanger save, rename, and create-folder features until patched.
Restrict local user permissions so the game process cannot write to sensitive directories.
Run the affected application under a non-privileged account isolated from production data.

bash

# Verify installed MenyooSP source is patched
git -C MenyooSP log --oneline | grep 729aa48 || echo "VULNERABLE: update to commit 729aa48 or later"