CVE-2026-44933
High · 7.8CVSS
7.8
EPSS
0.2%
Published
May 20, 2026
CISA due date
—
The record
`PluginScript` attempts to `chroot` the plugin to the `repoManagerRoot`, this root is frequently `/` (the system root) in standard configurations or when using `--root`. If the chroot target is `/`, it is a no-op, allowing the traversed path to execute host binaries (like `/bin/bash`) with root privileges.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | libsolv | 0 | 0.7.39-160000.1.1 |
| openSUSE:Leap 16.0 | libzypp | 0 | 17.38.13-160000.1.1 |
| openSUSE:Leap 16.0 | zypper | 0 | 1.14.98-160000.1.1 |
| openSUSE:Tumbleweed | libzypp | 0 | 17.38.9-1.1 |
Related vulnerabilities
- CVE-2026-48863 A flaw was found in libsolv. Also affects libsolv
- CVE-2026-44941 A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before… Also affects libsolv
- CVE-2026-44942 A path traversal in handling the "path" component of .repo files processed by libzypp… Also affects libsolv
- CVE-2026-9149 A flaw was found in libsolv. Also affects libsolv
- CVE-2026-9150 A flaw was found in libsolv. Also affects libsolv
- CVE-2026-85310 import_contacts Path Traversal in Groundhogg <= 4.7.1 versions. CWE-35
- CVE-2026-21103 Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physical… CWE-35
- CVE-2026-21092 Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to… CWE-35