libzypp path traversal via "keyhint" in repomd.xml

published 2026-07-02 4 mo ago modified 2026-10-25 14 d ago also EUVD-2026-41406

cvss: 8.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits: 0; none known

A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious repository to inject or overwrite files in the target system as root.

Patch / fix

fixed in 1 distros 3 links 1

SUSE libzypp 17.38.12

debian suse opensuse

libzypp Debian 14 17.38.12-1

debian advisories DEBIAN-CVE-2026-44941

zypper SLES 15 SP4-LTSS, SLE Micro 5.4, SLE Micro 5.3 +2 more 1.14.98-150400.3.104.1
libsolv SLES 15 SP4-LTSS, SLE Micro 5.4, SLE Micro 5.3 +3 more 0.7.39-150400.3.46.1
libzypp SLES 15 SP4-LTSS, SLE Micro 5.4, SLE Micro 5.3 +3 more 17.38.13-150400.3.158.1
libsolv SLES 15 SP6-LTSS, SLE Installer Updates 15 SP6 0.7.39-150600.8.24.1
libzypp SLES 15 SP6-LTSS, SLE Installer Updates 15 SP6 17.38.13-150600.3.92.1
zypper SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 1.14.98-150500.6.45.1
libsolv SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +3 more 0.7.39-150500.6.17.1
libzypp SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +3 more 17.38.13-150500.6.74.1

suse advisories SUSE-SU-2026:2674-1 SUSE-SU-2026:2590-1 SUSE-SU-2026:2575-1 SUSE-SU-2026:2531-1 SUSE-SU-2026:22172-1 SUSE-SU-2026:22221-1

libsolv openSUSE Leap 16.0 0.7.39-160000.1.1
zypper openSUSE Leap 16.0 1.14.98-160000.1.1
libzypp openSUSE Leap 16.0 17.38.13-160000.1.1
libzypp openSUSE Tumbleweed 17.38.13-1.1

opensuse advisories openSUSE-SU-2026:21096-1 openSUSE-SU-2026:10984-1

github.com/openSUSE/libzypp@294b1ba commit

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 4 mo ago (2026-07-03)

Exploit prediction

0.53% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

bugzilla.suse.com https://bugzilla.suse.com/show_bug.cgi?id=1267426 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.4	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

SUSE libzypp

Classification

Weakness

CWE-23 Relative Path Traversal

References

github.com /openSUSE/libzypp/commit/294b1bad442d089ca671c5c03adc8031e3b29e04
patch
bugzilla.suse.com /show_bug.cgi?id=1267426
issue-tracking, exploit, third-party-advisory

Sources

CVE List CVE-2026-44941
NVD CVE-2026-44941

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary