Executive brief
Slopsmith is a web application used to manage and play custom content for the Rocksmith 2014 video game. A security flaw in how the application handles uploaded files allows an attacker to place malicious files anywhere on the server's file system. In many common setups, this can lead to a complete takeover of the server, potentially allowing attackers to steal data or disrupt operations.
Technical details
A path traversal vulnerability exists in Slopsmith's archive extractors within `lib/psarc.py`, `lib/patcher.py`, and `lib/sloppak.py`. The root cause is the lack of validation for filenames within PSARC and sloppak archives, specifically the use of Python's `ZipFile.extractall()` without a member filter. An attacker can craft an archive containing '..' segments or absolute paths to write files outside the intended extraction directory. When running in the default Docker configuration as root, this allows an attacker to drop files into the plugin directory and achieve remote code execution (RCE) on the host. The issue is fixed in version 0.2.9-alpha.5.
Affected products
- byrongamatos slopsmith < 0.2.9-alpha.5
Timeline
- 2026-06-19: disclosed
- 2026-06-19: advisory
- 2026-06-19: patched