A path-traversal flaw exists in Slopsmith’s archive extractors that allows an attacker to write files outside the intended extraction directory. By supplying a crafted PSARC or sloppak archive, the application blindly concatenates entry names to the target path. This flaw can lead to arbitrary file creation, including overwriting system executables. If the application is run with elevated privileges, such as the default Docker image that runs as root, the attacker can then execute code on the host system. The weakness is a classic path traversal (CWE‑22/23/36).

The vulnerability affects the Slopsmith web application developed by byrongamatos. Versions prior to 0.2.9‑alpha.5 are affected. The flaw is present in the PSARC, patcher, and sloppak archive handlers. Containers using the default Docker image, which runs as root, are especially vulnerable when the Slopsmith instance is reachable.

The CVSS score of 7.6 classifies the issue as high severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. An attacker only needs to supply a malicious archive; no network-facing service is required beyond accessing the web interface. In a typical Docker deployment, the attacker can elevate privileges if the container runs as root and can write to the plugin directory, leading to remote code execution.