The Vulnerability

Litematica's Servux protocol uses a custom plugin channel (servux:litematics) to transfer litematic schematics from server to client. The protocol transmits NBT-compound messages over Netty with a FileName field that specifies where on the client's filesystem the received data should be written.

The flaw: the FileName value is never sanitized. By supplying ../../mods/payload.jar, an attacker can traverse out of the intended .minecraft/litematics/ directory and write a file anywhere the Minecraft client process can write - most critically into the mods/ folder.

Protocol Walkthrough

The exploit uses three NBT messages sent over the servux:litematics channel. The server wraps each message in a compound with type=11 (the NBT response type the client expects for litematic transfers):

{
  "Task": "Litematic-TransmitStart",
  "SliceKey": <random_long>,
  "FileName": "../../mods/poc.litematic.jar",
  "FileType": "litematic",
  "TotalSlices": 1,
  "TotalSize": <payload_size>
}

{
  "Task": "Litematic-TransmitData",
  "SliceKey": <same_key>,
  "Slice": 0,
  "Size": <payload_size>,
  "Data": <raw_jar_bytes>
}

{
  "Task": "Litematic-TransmitEnd",
  "SliceKey": <same_key>,
  "TotalSize": <payload_size>,
  "TotalSlices": 1
}

Wire Format

Each message is wrapped in a type-length-value structure before being sent over the Fabric networking API:

[VarInt total_length]
  [VarInt NBT_RESPONSE_DATA_TYPE (11)]
    [VarInt nbt_length]
    [NBT Compound]

The receiving Litematica client reads the type discriminator (11), dispatches to its NBT handler, which parses the compound and - upon seeing TransmitStart - creates a file output stream at the path constructed from FileName without any path traversal checks.

Attack Flow

1. Join server - the exploit mod (running on the server) hooks ServerPlayConnectionEvents.JOIN and waits 3 seconds (60 ticks).
2. Send Start - a TransmitStart packet is sent with FileName = "../../mods/malicious.jar".
3. Send Data - after a 2-tick delay, the raw bytes of a malicious Fabric mod are transmitted as the Data field.
4. Send End - after another 2 ticks, a TransmitEnd finalizes the transfer. The client closes the file handle.
5. RCE - the malicious .jar now resides in the victim's mods/ folder. On the next restart, arbitrary code executes in the Minecraft client process.

This writeup is not by the original discoverers. I (AliensToEarth) was not involved in the early finding or reporting the vulnerability. I became aware of the RCE through community chatter and decided to investigate the source code myself. While doing so, I noticed the developer had pushed a fix commit without any public announcement. I reverse engineered the vulnerability from the diff, developed this PoC independently, and am publishing this technical breakdown for the transparency.

The original vulnerability was found and responsibly disclosed by 数字 and Nightwane from Autism Inc / DupersUnited, who coordinated with the developer to get it patched. The public @everyone announcement was made by Sakura Ryoko on 2026-07-06 at 23:30 UTC+4.

The proof-of-concept code for this writeup is available in the PoC repository.