CVE-2026-44942CWE-24

libzypp .repo files can have an optional path which can lead to path traversal attacks

Medium · published June 18, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
41.8
In the wild
Unconfirmed
What it is

A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x series, or before 16.22.19 could be used by attackers to fill directories on the system outside of the zypp cache with content.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00498 · 41.8th percentile
Weakness
CWE-24 · Path Traversal: '../filedir'
Published
2026-06-18T09:57Z
EPSS history
Timeline
  • 18 JUN 09:57Z
    libzypp .repo files can have an optional path which can lead to path traversal attacks
    cvelistv5