Slopsmith CVE-2026-49290

Requires that a Slopsmith user (operator of the instance) open a crafted PSARC or sloppak archive supplied by the attacker via Slopsmith's archive-extraction code paths (lib/psarc.py::unpack_psarc, lib/patcher.py::unpack_psarc, or lib/sloppak.py::_unpack_zip). Escalation from arbitrary file write to host RCE specifically requires the default Docker deployment running as root with a writable plugin directory that Slopsmith loads code from; non-Docker installs or hardened containers running as non-root suffer arbitrary file write within the process's permissions but not automatic root-level code execution. Exploitation is limited by the niche user base, the absence of any documented unauthenticated upload endpoint, and the vendor's guidance against exposing the instance to the internet - there is no indication a network-side attacker can force extraction without an operator action.

The 4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U scores 7.6, with full CIA impact on both the vulnerable Slopsmith container and the host (subsequent scope) because the default Docker image runs as root and a writable plugin path enables RCE. E:U (unreported) is consistent with no KEV entry and no POC reference in the inputs. Real-world risk is meaningfully bounded: Slopsmith is a niche hobbyist application for Rocksmith CDLC and is explicitly advised by the vendor not to be exposed to the public internet, so the attack surface skews toward single-user/LAN deployments - but any user who downloads a malicious CDLC from a community forum is one click away from full host compromise, which is a realistic delivery path for this user base. PR:H in the CVSS vector appears to reflect that an authenticated Slopsmith operator must initiate the open/extract action; defenders should note this is closer to a 'malicious-content' threat model than an unauthenticated remote attack, even though the vector lists AV:N.

An attacker publishes a booby-trapped CDLC PSARC (or sloppak bundle) on a Rocksmith community site containing an entry whose filename is something like '../../app/plugins/evil.py'. When a Slopsmith user downloads and opens it, the extractor writes the payload into the plugin directory; because the default Docker container runs as root and Slopsmith auto-loads plugins, the payload executes with root privileges on the host. No public exploit code was identified in the references at time of analysis, but the bug pattern is well known and trivially weaponized.