UBUNTU-CVE-2026-104620: Path Traversal

Published Nov 10, 2026

Updated

A path traversal attack in simulation of actions in the Zypp backend of PackageKit before 1.4.1 could be used by local attackers to gain root privileges.

Affected Software

7 affected components

ubuntu/packagekit*

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

A local attacker can exploit it. The provided vector indicates that the attacker needs low privileges and does not require user interaction.

What level of impact could exploitation have?

Successful exploitation could allow a local attacker to gain root privileges. The severity vector indicates high impact to confidentiality, integrity, and availability, including subsequent system impacts.

Which PackageKit versions are affected?

The issue affects the Zypp backend action-simulation functionality in PackageKit versions before 1.4.1.

UBUNTU-CVE-2026-104620: Path Traversal

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What level of impact could exploitation have?

Which PackageKit versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What level of impact could exploitation have?

Which PackageKit versions are affected?