CVE-2026-49290

Slopsmith (CVE-2026-49290) contains a path-traversal vulnerability in archive extractors prior to version 0.2.9-alpha.5 that allows writing arbitrary files outside the extraction directory by crafted PSARC or sloppak archives. The issue affects three extractors: lib/psarc.py::unpack_psarc (PSARC ...