CVE-2026-44942 — libzypp .repo files can have an optional path which can lead to path traversal attacks

CVE-2026-44942

libzypp .repo files can have an optional path which can lead to path traversal attacks PUBLISHED

Description (CNA)

A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x series, or before 16.22.19 could be used by attackers to fill directories on the system outside of the zypp cache with content.

Affected (CNA)

Vendor / product	Versions
SUSE / libzypp	affected 17.0.0 before 17.38.13; affected 0 before 16.22.19

CWE

CWE-24

References

https://bugzilla.suse.com/show_bug.cgi?id=1267874
https://www.suse.com/security/cve/CVE-2026-44942.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.