Directory Traversal in Menyoo 2.0 via Spooner File Management

Executive Summary

CVE-2026-52349 is a Directory Traversal vulnerability in Menyoo 2.0 versions before commit 729aa48. It allows a local attacker to execute arbitrary code through file management features like Spooner, VehicleSpawner, WeaponOptions, and PedComponentChanger by manipulating file paths to access restricted directories.

Useful 0 Not Useful 0

Detection Guidance

Check for Menyoo 2.0 versions before commit 729aa48. Inspect file management operations in Spooner, VehicleSpawner, WeaponOptions, and PedComponentChanger for unusual path handling or directory traversal attempts like '..' or path separators.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to overwrite critical files in different directories, potentially causing system instability or executing malicious code. This is particularly risky for multiplayer environments like FiveM where modified versions of Menyoo are used.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability could lead to unauthorized file access or overwrites, potentially compromising data integrity and confidentiality. This may impact compliance with standards like GDPR (data protection) or HIPAA (health data security) by increasing risks of data breaches or unauthorized modifications.

Useful 0 Not Useful 0

Mitigation Strategies

Update to the latest version of MenyooSP with commit 729aa48 or later. Ensure the 'IsSafePath' validation is enforced in file operations. Remove or restrict write access to sensitive directories.

Useful 0 Not Useful 0