CVE-2026-44933: Path Traversal in Plugin Loading in libzypp
PluginScript attempts to chroot the plugin to the repoManagerRoot, this root is frequently / (the system root) in standard configurations or when using --root. If the chroot target is /, it is a no-op, allowing the traversed path to execute host binaries (like /bin/bash) with root privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44933?
CVE-2026-44933 is considered a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2026-44933?
To fix CVE-2026-44933, ensure that your libzypp installation is updated to the latest version that addresses this vulnerability.
What are the potential impacts of CVE-2026-44933?
The potential impacts of CVE-2026-44933 include unauthorized access to the file system and execution of arbitrary code.
Who is affected by CVE-2026-44933?
CVE-2026-44933 affects users of openSUSE libzypp, particularly those utilizing standard configurations.
What is the nature of the vulnerability described in CVE-2026-44933?
CVE-2026-44933 is a path traversal vulnerability in the plugin loading mechanism of libzypp.