Path Traversal in libzypp Before 17.38.13

Executive Summary

CVE-2026-44942 is a path traversal vulnerability in libzypp, a software library used for package management in SUSE Linux systems.

The vulnerability arises from the handling of the "path" component in .repo files processed by libzypp before versions 17.38.13 (17.x series) and 16.22.19 (16.x series).

An attacker can exploit this flaw by crafting .repo files with a malicious "path" directive, allowing them to write files outside the intended zypp cache directory.

This means attackers could fill arbitrary system directories with content, potentially causing system issues.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact system availability by allowing attackers to write arbitrary files outside the zypp cache directory.

By filling system directories with unwanted content, it could lead to disk space exhaustion or disruption of normal system operations.

The CVSS v3.1 score of 6.5 indicates a medium severity, primarily affecting the availability of the system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the CVE-2026-44942 vulnerability, you should update libzypp to a fixed version. The vulnerability is addressed in libzypp versions 17.38.13 (for the 17.x series) and 16.22.19 (for the 16.x series).

SUSE has released security updates including SUSE-SU-2026:22073-1 and SUSE-SU-2026:22064-1, which include patches for affected products such as SUSE Linux Micro 6.0 and 6.1, SUSE Linux Enterprise, and openSUSE Tumbleweed.

Applying these updates and patches promptly will prevent attackers from exploiting the path traversal vulnerability in .repo files processed by libzypp.

Useful 0 Not Useful 0

Detection Guidance

Detection of CVE-2026-44942 involves checking for vulnerable versions of libzypp installed on the system and inspecting .repo files for malicious or unexpected "path" directives that could be exploited for path traversal.

You can verify the installed libzypp version using package management commands to ensure it is updated to at least version 17.38.13 (for 17.x series) or 16.22.19 (for 16.x series), which contain the fixes.

• Check libzypp version: rpm -q libzypp
• Inspect .repo files for suspicious "path=" entries that might indicate exploitation attempts, for example: grep -r "path=" /etc/zypp/repos.d/
• Monitor system directories outside the zypp cache for unexpected files or directories that could have been created by exploitation.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0