CVE-2026-44941: CWE-23 Relative path traversal in SUSE libzypp
A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious repository to inject or overwrite files in the target system as root.
AI Analysis
Technical Summary
This vulnerability is a relative path traversal (CWE-23) in the 'keyhint' option of repomd.xml parsing within libzypp versions prior to 17.38.12. Exploiting this flaw allows an attacker with the ability to provide a malicious repository to write or overwrite arbitrary files on the system as root. The CVSS 3.1 score is 8.4, reflecting high impact with network attack vector, low attack complexity, required privileges, and user interaction, and resulting in high confidentiality, integrity, and availability impacts.
Potential Impact
Successful exploitation can lead to arbitrary file injection or overwriting on the affected system with root privileges, compromising system integrity, confidentiality, and availability. This could allow attackers to execute arbitrary code or disrupt system operations.
Mitigation Recommendations
A fix is available in libzypp version 17.38.12 and later. Users should upgrade to version 17.38.12 or newer to remediate this vulnerability. Patch status is not explicitly confirmed beyond the version information, so users should consult the official SUSE advisory for the latest remediation guidance.
CVE-2026-44941: CWE-23 Relative path traversal in SUSE libzypp
Description
A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious repository to inject or overwrite files in the target system as root.
CVSS v3.1
Score 8.4high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability is a relative path traversal (CWE-23) in the 'keyhint' option of repomd.xml parsing within libzypp versions prior to 17.38.12. Exploiting this flaw allows an attacker with the ability to provide a malicious repository to write or overwrite arbitrary files on the system as root. The CVSS 3.1 score is 8.4, reflecting high impact with network attack vector, low attack complexity, required privileges, and user interaction, and resulting in high confidentiality, integrity, and availability impacts.
Potential Impact
Successful exploitation can lead to arbitrary file injection or overwriting on the affected system with root privileges, compromising system integrity, confidentiality, and availability. This could allow attackers to execute arbitrary code or disrupt system operations.
Mitigation Recommendations
A fix is available in libzypp version 17.38.12 and later. Users should upgrade to version 17.38.12 or newer to remediate this vulnerability. Patch status is not explicitly confirmed beyond the version information, so users should consult the official SUSE advisory for the latest remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- suse
- Date Reserved
- 2026-05-08T12:29:48.968Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a468c9f27e9c79719a1cee8
Added to database: 07/02/2026, 16:06:55 UTC
Last enriched: 07/10/2026, 08:37:20 UTC
Last updated: 08/16/2026, 12:41:09 UTC
Views: 84
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.