CVE-2026-44942: libzypp .repo files can have an optional path which can lead to path traversal attacks
A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x series, or before 16.22.19 could be used by attackers to fill directories on the system outside of the zypp cache with content.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libzyppto a version that resolves this vulnerability.Fixed in 17.38.13 - Upgrade
Upgrade
libzyppto a version that resolves this vulnerability.Fixed in 16.22.19
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44942?
CVE-2026-44942 has a medium severity rating of 6.5.
How do I fix CVE-2026-44942?
To fix CVE-2026-44942, upgrade libzypp to version 17.38.13 or later for the 17.x series, or version 16.22.19 or later.
What type of attack does CVE-2026-44942 enable?
CVE-2026-44942 enables path traversal attacks that can lead to unauthorized file modifications outside the zypp cache.
Which software is affected by CVE-2026-44942?
CVE-2026-44942 affects the openSUSE Libzypp software.
What is the impact of a successful exploitation of CVE-2026-44942?
Successful exploitation of CVE-2026-44942 can allow attackers to fill directories on the system with unwanted content.