Malformed save files (.sav) allow to write files with arbitrary extensions and content in GoldSrc-based games.

The structure of the save file implies unpacking of temporary files with extensions , and . In the code of command 'load', there is a check for invalid substrings, such as , so unpacking the files into the top directories will not work. Also, it seems, there is a code for checking the file …

In the attached archive there is a demonstration file