From 7408e55478ab7361e9abeb052d3ac7f8c2dd9d35 Mon Sep 17 00:00:00 2001 From: valenciana-nc Date: Thu, 15 Oct 2026 02:36:37 +0000 Subject: [PATCH] fix(libkernel_sys): reject parent-directory components in symlink targets symlink_nid_postfix blocked absolute targets but accepted relative targets containing '..' unchecked. The target is stored verbatim and the host OS follows it when the link is later opened through the guest path resolver, so symlink("../../../../..", "e") followed by sceKernelOpen("e/etc/passwd", ...) reads host files outside the guest root. Reject any '..' component, mirroring the absolute-target handling above it. --- core/libs/prx/libkernel_sys/Export.cpp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/core/libs/prx/libkernel_sys/Export.cpp b/core/libs/prx/libkernel_sys/Export.cpp index d438fa7b6b..197bd0a556 100644 --- a/core/libs/prx/libkernel_sys/Export.cpp +++ b/core/libs/prx/libkernel_sys/Export.cpp @@ -375,6 +375,12 @@ int APS5_VABI symlink_nid_postfix(const char* target, const char* created) { NotImplemented_nid_no_patch("symlink: absolute targets"); return -1; } + for (const auto& part : std::filesystem::path(target)) { + if (part == "..") { + NotImplemented_nid_no_patch("symlink: parent-directory targets"); + return -1; + } + } std::filesystem::path native; if (const int error = ResolvePathError_nid_no_patch(created, native)) return static_cast(Fail(error)); std::error_code error;