Litematica vulnerability: fixed versions

In July 2026 the Litematica maintainer announced a vulnerability in certain Litematica and Servux versions for Minecraft 1.21 and newer. A server could send files other than schematics and make the client save them outside the schematics folder. Fixed builds exist for every 1.21+ version. This page lists them and the steps to update.

1. Find your Minecraft version and your Litematica version (see the check page linked below).
2. Compare Litematica with the fixed version for your Minecraft version in the table.
3. If yours is older, download the fixed build from the Litematica page on Modrinth and the MaLiLib build it needs.
4. Delete the old Litematica jar from the mods folder, add the new one, and restart Minecraft.
5. If you run a server with Servux, update Servux to the fixed build for that Minecraft version too.

Fixed versions by Minecraft version

The table is the list in the maintainer’s announcement on r/litematica, dated 2026-07-05 to 2026-07-06. Later builds can be newer: Modrinth lists Litematica 0.28.8 for 26.2 as of 2026-09-05. Always take the newest build for your Minecraft version, not the number in the table if a higher one exists.

What was wrong

Litematica can receive schematic files from a server that runs Servux. The client writes them into a transmit folder under the schematics folder. In affected builds the file name was not cleaned, so a name with parent-folder parts could land somewhere else, such as the mods folder. The maintainer said the consequence could be malware on the receiving side.

By the maintainer’s reading of the git history, the change was first in 1.21.5-0.22.2-sakura.4 (commit of 19 May 2025), then backported on 31 December 2025 to 1.21.4-0.21.6, 1.21.3-0.20.8 and 1.21-0.19.60. All 1.21.6 and later builds had it until the fixed releases. He also said he was not fully sure of the exact start.

Who was at risk

A player with an affected Litematica who joined a malicious server, or a trusted server whose vulnerable Servux had itself been compromised. Players who only use single player with no server joins are not in the described route, but updating costs a few minutes. Servux, which gives Litematica its direct server paste, only matters if you run the server.

How to look for signs

The maintainer suggested searching your computer for file names that contain .litematic anywhere other than as the real extension, for example something.litematic.jar in the mods folder. He added that this is not a guarantee, since malware can rename or remove itself. If you find such a file, treat the machine as compromised: stop using it for passwords, scan it, and change important passwords from a clean device.

Generate a .litematic

Update steps in detail

Step by step, with the MaLiLib match and the old-jar cleanup, is on how to update Litematica. To read your current version off the file name, see what Litematica version do I have. For first installs, use how to install Litematica, and take the download from the Modrinth project page, not from a chat link.

This site

The generator on this site writes .litematic and .schem block files. It does not run Servux, send files to your game, or touch your mods folder. How to sanity-check any file you did not make yourself is on is a .litematic file safe.

Sources: the maintainer’s announcement on r/litematica (2026-07-06); the Litematica and Servux project pages on Modrinth, checked 2026-10-02. This site is not affiliated with the mod’s authors.

Reviewed 2026-10-02. Not affiliated with Mojang or Microsoft.