Medium severity · published Jun 18, 2026
CVE-2026-44942
libzypp .repo files can have an optional path which can lead to path traversal attacks
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x series, or before 16.22.19 could be used by attackers to fill directories on the system outside of the zypp cache with content.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
libzypp · SUSE
17.0.0 before 17.38.13; before 16.22.19 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44942
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44942
bugzilla.suse.com
https://bugzilla.suse.com/show_bug.cgi?id=1267874
www.suse.com
https://www.suse.com/security/cve/CVE-2026-44942.html
More from libzypp
8.8
CVE-2026-44941
libzypp path traversal via "keyhint" in repomd.xml
8.8
CVE-2026-25707
Handcrafted repo metadata may cause arbitrary local files to be overwritten by libzypp