libzypp CVE-2026-44942

Exploitation requires that an attacker can cause libzypp to parse a .repo file containing a path traversal sequence in the 'path' field. The CVSS PR:L metric indicates low-privilege authenticated access is necessary - typically, the ability to write to /etc/zypp/repos.d/ or to pass a crafted repository URI to a zypper command. On default SUSE configurations, only root or members of privileged groups can modify system repository definitions, so direct exploitation by unprivileged local users is limited. However, the AV:N (network) vector suggests the attack path includes scenarios where repository metadata is fetched from an attacker-controlled remote source, or where a low-privileged user can register a custom repository. Exploitation is further limited to systems running libzypp 16.x prior to 16.22.19 or 17.x prior to 17.38.13; the impact is confined to disk availability with no confidentiality or meaningful code-execution primitive identified.

The CVSS 3.1 base score of 6.5 reflects a network-accessible (AV:N), low-complexity (AC:L), low-privilege (PR:L) attack with no user interaction (UI:N), scoped to availability impact only (A:H, C:N, I:N). This framing is consistent with the description: the flaw is fundamentally a disk-filling attack rather than a code execution primitive. EPSS data was not provided in the intelligence sources, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public proof-of-concept identified. The PR:L metric indicates that some degree of authenticated access or repository management capability is required, limiting opportunistic exploitation from anonymous internet actors. The S:U (unchanged scope) metric confirms the attack does not pivot to compromise additional system components beyond disk availability. Real-world priority should be moderate: environments where low-privileged users can introduce or modify .repo files (e.g., shared build systems, CI pipelines, developer workstations) face greater risk than locked-down production servers where repository configuration is admin-controlled.

An attacker with low-privileged access to a system - or the ability to supply a crafted .repo file to a privileged zypper operation (e.g., via a CI pipeline that adds third-party repositories) - crafts a repository definition containing a traversal payload in the 'path' field such as '../../../../../../tmp/attacker'. When libzypp processes this repository during a refresh or package installation operation, it writes cached metadata and package content into the traversal-resolved directory, progressively filling the targeted filesystem partition and causing a denial of service. No public proof-of-concept code has been identified, but the vulnerability class (CWE-24) is well-understood and exploitation requires no special tooling beyond a crafted .repo file.