CVE-2026-44941
High · 8.4CVSS
8.4
EPSS
0.5%
Published
Jul 2, 2026
CISA due date
—
The record
A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious repository to inject or overwrite files in the target system as root.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | libsolv | 0 | 0.7.39-160000.1.1 |
| openSUSE:Leap 16.0 | libzypp | 0 | 17.38.13-160000.1.1 |
| openSUSE:Leap 16.0 | zypper | 0 | 1.14.98-160000.1.1 |
| openSUSE:Tumbleweed | libzypp | 0 | 17.38.13-1.1 |
Related vulnerabilities
- CVE-2026-48863 A flaw was found in libsolv. Also affects libsolv
- CVE-2026-44942 A path traversal in handling the "path" component of .repo files processed by libzypp… Also affects libsolv
- CVE-2026-9149 A flaw was found in libsolv. Also affects libsolv
- CVE-2026-9150 A flaw was found in libsolv. Also affects libsolv
- CVE-2026-44933 `PluginScript` attempts to `chroot` the plugin to the `repoManagerRoot`, this root is… Also affects libsolv
- CVE-2026-114714 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal… CWE-23
- CVE-2026-106552 In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files… CWE-23
- CVE-2026-89065 Relative path traversal in the generated file manifest cleanup component in projen before… CWE-23