Executive brief
Menyoo is a popular modification tool for Grand Theft Auto V that allows players to manage game assets, vehicles, and character components. A security flaw in how the tool handles file and folder names allows a local attacker to bypass intended directory restrictions. This could lead to the execution of unauthorized code or the manipulation of sensitive files on the user's computer.
Technical details
A directory traversal vulnerability (CWE-22) exists in Menyoo 2.0 before commit 729aa48 due to insufficient sanitization of user-provided input in the Spooner, VehicleSpawner, WeaponOptions, and PedComponentChanger modules. Specifically, the application failed to validate file and folder names against traversal sequences like '..', path separators, and Windows reserved filenames. A local attacker can exploit this by providing specially crafted strings during save, rename, or folder creation operations to access locations outside the intended directory. This can be leveraged to achieve arbitrary code execution. The fix introduces a whitelist-based 'IsSafePath' validation function.
Affected products
- itsjustcurtis Menyoo 2.0 (MenyooSP) Before commit 729aa48
Timeline
- 2026-05-11: disclosed: Vulnerability reported via GitHub Pull Request
- 2026-05-14: patched: Fixed in commit 729aa48
- 2026-07-20: advisory: CVE-2026-52349 published