Vita3K versions before build 4187 contain a path traversal flaw in the function install_archive_content, allowing a crafted .vpk archive to write files outside the intended installation directory. The vulnerability, known as zip slip, lets the attacker embed '..' segments or absolute paths in entry names, resulting in arbitrary file creation. If the victim can write over system binaries or launch executables, this defect could lead to host code execution.

Systems running Vita3K prior to build 4187 are affected. The flaw exists for all builds before 4187, regardless of minor patch numbers, and applies to the primary Vita3K emulator on Windows, macOS, and Linux platforms.

The CVSS score of 6.7 reflects a moderate-to-high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers need to supply a malicious .vpk archive, which suggests a local or user‑initiated vector. If the package is installed on a user’s system, the attacker can place arbitrary files, potentially enabling remote persistence or execution of malicious code.