CVE-2026-104620: PackageKit/ZYpp local privilege escalation using InstallFiles(SIMULATE)
Published Nov 9, 2026
·Updated
A path traversal attack in simulation of actions in the Zypp backend of PackageKit before 1.4.1 could be used by local attackers to gain root privileges.
Affected Software
1 affected component
PackageKit PackageKit<1.4.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PackageKit (ZYpp backend)to a version that resolves this vulnerability.Fixed in 1.4.1
Event History
Nov 9, 2026
CVE Published
via MITRE·02:31 PM
Data Sourced
via MITRE·02:31 PM
DescriptionWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs local access and low-level privileges on a system using the Zypp backend of PackageKit. Successful exploitation can result in root privileges.
2
Which versions are affected?
The issue affects PackageKit versions before 1.4.1 when using the Zypp backend.
3
What operation is involved in exploitation?
The vulnerability is in simulation of actions through InstallFiles(SIMULATE). The attack uses path traversal during that simulation process.