CVE-2026-52349

Deferred Deferred - Pending Action

Directory Traversal in Menyoo 2.0 via Spooner File Management

Publication date: 2026-07-20

Last updated on: 2026-07-23

Assigner: MITRE

Description

Directory Traversal vulnerability in Menyoo 2.0 Versions before commit 729aa48: fixed in commit 729aa48 allows a local attacker to execute arbitrary code via the Spooner file management, VehicleSpawner save/folder/rename functionality, WeaponOptions save/folder/rename functionality, PedComponentChanger create folder/createfile/rename functionality.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-07-23

Generated

2026-08-10

AI Q&A

2026-07-20

EPSS Evaluated

2026-08-09

NVD

CVE-2026-52349

EUVD

EUVD-2026-45946

Affected Vendors & Products

Vendor	Product	Version / Range
itsjustcurtis	menyoo	to 729aa48 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-52349 is a Directory Traversal vulnerability in Menyoo 2.0 versions before commit 729aa48. It allows a local attacker to execute arbitrary code through file management features like Spooner, VehicleSpawner, WeaponOptions, and PedComponentChanger by manipulating file paths to access restricted directories.

Detection Guidance

Check for Menyoo 2.0 versions before commit 729aa48. Inspect file management operations in Spooner, VehicleSpawner, WeaponOptions, and PedComponentChanger for unusual path handling or directory traversal attempts like '..' or path separators.

Impact Analysis

An attacker could exploit this to overwrite critical files in different directories, potentially causing system instability or executing malicious code. This is particularly risky for multiplayer environments like FiveM where modified versions of Menyoo are used.

Compliance Impact

The vulnerability could lead to unauthorized file access or overwrites, potentially compromising data integrity and confidentiality. This may impact compliance with standards like GDPR (data protection) or HIPAA (health data security) by increasing risks of data breaches or unauthorized modifications.

Mitigation Strategies

Update to the latest version of MenyooSP with commit 729aa48 or later. Ensure the 'IsSafePath' validation is enforced in file operations. Remove or restrict write access to sensitive directories.

Hi! I’m here to help you understand CVE-2026-52349. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70