What is the CVSS score of CVE-2026-44941?

CVE-2026-44941 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of libzypp are affected by CVE-2026-44941?

The SUSE package manager (libzypp) contains a path traversal vulnerability allowing complete system compromise if users add malicious repositories, directly threatening organizations operating SUSE…. A patch is available.

How to fix or mitigate CVE-2026-44941?

Within 24 hours: Inventory systems running libzypp versions before 17.38.12. Within 7 days: Update libzypp to version 17.38.12 or later across all affected systems. Within 30 days: Audit configured software repositories and implement policies restricting third-party repository additions.

libzypp CVE-2026-44941

EUVD-2026-41406 HIGH

Relative Path Traversal (CWE-23)

2026-07-02 suse

GHSA-wp9x-wjhc-28mv

Path Traversal Libzypp Suse

8.8

CVSS 3.1 · NVD

Severity by source

Vendor (suse) PRIMARY

HIGH

qualitative

NVD

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Repo metadata is network-delivered (AV:N) with no attacker privileges (PR:N) but requires the victim to add/refresh the malicious repo (UI:R); root file overwrite yields total integrity/availability loss and code-execution-driven confidentiality impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (suse).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 07, 2026 - 17:44 vuln.today

v3 (cvss_changed)

Source Code Evidence Fetched

Jul 07, 2026 - 17:43 vuln.today

Analysis Updated

Jul 07, 2026 - 17:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 07, 2026 - 17:37 vuln.today

cvss_changed

CVSS changed

Jul 07, 2026 - 17:37 NVD

8.4 (HIGH) 8.8 (HIGH)

Analysis Generated

Jul 02, 2026 - 16:31 vuln.today

DescriptionNVD

A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious repository to inject or overwrite files in the target system as root.

AnalysisAI

Arbitrary root file write in libzypp before 17.38.12 lets an attacker who can get a victim to add or refresh a malicious software repository overwrite or inject files anywhere on the system as root, because the "keyhint" value in repomd.xml is parsed without rejecting path separators (CWE-23 relative path traversal). Because libzypp performs repository operations with root privileges on SUSE/openSUSE systems, this escalates directly to full host compromise. Publicly available exploit code exists (SSVC=poc); it is not listed in CISA KEV, and EPSS is low (0.49%, 38th percentile), consistent with a targeted rather than mass-exploited flaw.

Technical ContextAI

libzypp is the C++ package-management library underpinning zypper and YaST on SUSE Linux Enterprise and openSUSE, responsible for fetching and parsing repository metadata (repomd.xml) in the YUM/DNF metadata format. The flaw is in RepomdFileReader.cc, where the regular expression validating the gpg-pubkey "keyhint" entry accepted arbitrary characters including '/', allowing a repository-controlled string to be treated as a filesystem path. This is a classic CWE-23 relative path traversal: attacker-controlled metadata is used to construct a destination path for a key file, and traversal sequences let that path escape the intended keys directory. The vendor fix (commit 294b1bad) tightens the regex from "^(gpg-pubkey([^?]*))..." to "^(gpg-pubkey([^/?]*))...", explicitly forbidding '/' so the keyhint can no longer be a path.

RemediationAI

Vendor-released patch: upgrade libzypp to 17.38.12 or later, which fixes the keyhint regex to reject path separators (upstream commit https://github.com/openSUSE/libzypp/commit/294b1bad442d089ca671c5c03adc8031e3b29e04; tracking bug https://bugzilla.suse.com/show_bug.cgi?id=1267426). Apply the distribution package update for your SUSE/openSUSE release rather than building from source where possible. Until patched, the most effective compensating control is to only add and refresh repositories you fully trust and that are served over authenticated, integrity-protected channels: remove or disable any third-party, community, or mirror repositories of uncertain provenance, and avoid running 'zypper ref'/'zypper in' against untrusted repos. Enforcing GPG signature checking and TLS with certificate validation on all repositories reduces the chance an attacker can substitute malicious repomd.xml via MITM; the trade-off is operational friction for internal mirrors that lack signing. Avoid processing repositories supplied by untrusted users or automation until the update is deployed.

More in Libzypp

View all

CVE-2026-25707 HIGH This Week

8.8 Jun 29

Arbitrary file overwrite in libzypp before 17.38.10 lets a remote attacker who controls a software repository plant craf

CVE-2018-7685 HIGH This Week

7.8 Aug 31

The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the c

CVE-2026-44942 MEDIUM This Month

6.5 Jun 18

Path traversal in libzypp's .repo file processing enables low-privileged network-accessible attackers to write content i

CVE-2013-3704 MEDIUM This Month

4.3 Oct 28

The RPM GPG key import and handling feature in libzypp 12.15.0 and earlier reports a different key fingerprint than the

Same weakness CWE-23 – Relative Path Traversal

View all

CVE-2025-64446 CRITICAL POC

9.8

CVE-2024-27199 HIGH POC

7.3

CVE-2025-34510 HIGH POC

8.8

CVE-2026-34926 MEDIUM POC

6.7

CVE-2024-24578 CRITICAL POC

9.8

CVE-2025-52207 CRITICAL POC

9.9

CVE-2023-6825 CRITICAL POC

9.9

CVE-2022-1373 HIGH POC

7.2

Same technique Path Traversal

View all

CVE-2019-19781 CRITICAL POC

9.8

CVE-2021-21972 CRITICAL POC

9.8

CVE-2021-40444 HIGH POC

8.8

CVE-2021-27065 HIGH POC

7.8

CVE-2018-20250 HIGH POC

7.8

CVE-2022-37042 CRITICAL POC

9.8

CVE-2025-64446 CRITICAL POC

9.8

CVE-2022-30333 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
Container suse/ltss/sle15.4/sle15:15.4-6.29 Container suse/manager/4.3/proxy-httpd:4.3.18.9.79.16 Container suse/manager/4.3/proxy-salt-broker:4.3.18.9.69.16 Container suse/sle-micro-rancher/5.3:latest Container suse/sle-micro-rancher/5.4:5.4.4.5.138 Container suse/sle-micro/5.3/toolbox:16.3-6.11.242 Container suse/sle-micro/5.4/toolbox:16.3-5.19.243 Image SLES15-SP4-CHOST-BYOS Image SLES15-SP4-CHOST-BYOS-Aliyun Image SLES15-SP4-CHOST-BYOS-Azure Image SLES15-SP4-CHOST-BYOS-EC2 Image SLES15-SP4-CHOST-BYOS-GCE Image SLES15-SP4-CHOST-BYOS-SAP-CCloud	Affected
Container suse/ltss/sle15.5/sle15:15.5-8.46 Container suse/sle-micro/5.5/toolbox:16.3-3.12.150 Container suse/sle-micro/base-5.5:2.0.4-5.8.285	Affected
Container suse/ltss/sle15.6/sle15:15.6-5.66	Affected
Container suse/multi-linux-manager/5.1/x86_64/proxy-httpd:5.1.4.8.24.2 Container suse/multi-linux-manager/5.1/x86_64/proxy-salt-broker:5.1.4.9.22.2 Container suse/sle15:15.7-5.20.31 Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2-ECS-HVM	Affected
Container suse/multi-linux-manager/5.1/x86_64/server-saline:5.1.4.9.22.1 Image proxy-salt-broker-image Image server-saline-image	Affected

CVE-2026-44941 vulnerability details – vuln.today

Back

libzypp CVE-2026-44941

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

More in Libzypp

Same weakness CWE-23 – Relative Path Traversal

Same technique Path Traversal

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code