Description

An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-11T20:18:37.717Z",
  "pubdate": "2026-08-11T20:18:37.717Z",
  "executiveSummary": "An unauthenticated remote code execution vulnerability has been identified in GMS 9.5.1 (Build 9510.1044) and earlier versions.\nThe vulnerability allows a remote attacker to read sensitive data and perform arbitrary file write operations via a zipslip vector.\nThe flaw exposes vulnerable systems to critical risks, including complete system compromise, unauthorized data disclosure, and potential persistence mechanisms.\nExploitation requires network access to the target system but does not require any authentication or prior privileges, making it accessible to unauthenticated remote threat actors.\nSuccessful exploitation hinges on the application insecurely handling archive extractions without proper sanitization of file paths contained within the archive headers.",
  "technicalDetails": "The root cause of the vulnerability stems from insecure archive extraction handling, specifically vulnerable to the zipslip pattern where malicious zip archives contain directory traversal sequences such as dot-dot-slash in file paths.\nThe affected component is responsible for processing and decompressing archive files within GMS 9.5.1 (Build 9510.1044) and earlier versions.\nNetwork exposure is remote, as the vulnerable endpoint accepts unauthenticated requests containing the malicious payload.\nAuthentication requirements are none, and privilege requirements are unauthenticated, allowing any external attacker to initiate the attack chain.\nThe exploitation method involves crafting a maliciously structured archive where filenames utilize path traversal characters.\nThe attack flow proceeds as follows: First, the unauthenticated remote attacker transmits a specially crafted archive file to the vulnerable GMS instance via the exposed ingestion or processing vector. Second, the backend application processes the archive and attempts to extract its contents without validating or sanitizing the destination file paths. Third, due to the lack of path traversal checks, the extraction routine resolves the traversal sequences, allowing files to be written outside the intended target directory and overwriting critical system files or placing executable payloads in web-accessible directories. Fourth, the attacker leverages the arbitrary file write capability to achieve remote code execution or read sensitive configuration and system data.\nThe post-exploitation impact includes full system compromise, unauthorized modification of application logic, and exposure of confidential system information."
}