CVE-2026-44941

HIGH 8.4

libzypp path traversal via "keyhint" in repomd.xml

CVSS Score

8.4

EPSS Score

0.0%

EPSS Percentile

0th

A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious repository to inject or overwrite files in the target system as root.

CWE	CWE-23
Vendor	suse
Product	libzypp
Published	Jul 2, 2026
Last Updated	Jul 2, 2026

Stay Ahead of the Next One

Get instant alerts for suse libzypp

Be the first to know when new high vulnerabilities affecting suse libzypp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

SUSE / libzypp

0 < 17.38.12

References

NVD ↗ CVE.org ↗ EPSS Data ↗

bugzilla.suse.com: https://bugzilla.suse.com/show_bug.cgi?id=1267426 github.com: https://github.com/openSUSE/libzypp/commit/294b1bad442d089ca671c5c03adc8031e3b29e04

Credits

Trung Nguyen <[email protected]>