CVE-2026-44933

EUVD-2026-31074
`PluginScript` attempts to `chroot` the plugin to the `repoManagerRoot`, this root is frequently `/` (the system root) in standard configurations or when using `--root`. If the chroot target is `/`, it is a no-op, allowing the traversed path to execute host binaries (like `/bin/bash`) with root privileges.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 11%
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libsolv-devel
suse enterprise desktop 15 SP7
0.7.39-150700.11.10.1
fixed
suse enterprise sap 15 SP7
0.7.39-150700.11.10.1
fixed
suse enterprise server 15 SP4
0.7.39-150400.3.46.1
fixed
suse enterprise server 15 SP5
0.7.39-150500.6.17.1
fixed
suse enterprise server 15 SP6
0.7.39-150600.8.24.1
fixed
suse enterprise server 15 SP7
0.7.39-150700.11.10.1
fixed
libsolv-tools
suse enterprise desktop 15 SP7
0.7.39-150700.11.10.1
fixed
suse enterprise sap 15 SP7
0.7.39-150700.11.10.1
fixed
suse enterprise server 15 SP4
0.7.39-150400.3.46.1
fixed
suse enterprise server 15 SP5
0.7.39-150500.6.17.1
fixed
suse enterprise server 15 SP6
0.7.39-150600.8.24.1
fixed
suse enterprise server 15 SP7
0.7.39-150700.11.10.1
fixed
libsolv-tools-base
suse enterprise desktop 15 SP7
0.7.39-150700.11.10.1
fixed
suse enterprise sap 15 SP7
0.7.39-150700.11.10.1
fixed
suse enterprise server 15 SP4
0.7.39-150400.3.46.1
fixed
suse enterprise server 15 SP5
0.7.39-150500.6.17.1
fixed
suse enterprise server 15 SP6
0.7.39-150600.8.24.1
fixed
suse enterprise server 15 SP7
0.7.39-150700.11.10.1
fixed
libzypp
suse enterprise desktop 15 SP7
17.38.13-150700.6.13.1
fixed
suse enterprise sap 15 SP7
17.38.13-150700.6.13.1
fixed
suse enterprise server 15 SP4
17.38.13-150400.3.158.1
fixed
suse enterprise server 15 SP5
17.38.13-150500.6.74.1
fixed
suse enterprise server 15 SP6
17.38.13-150600.3.92.1
fixed
suse enterprise server 15 SP7
17.38.13-150700.6.13.1
fixed
libzypp-devel
suse enterprise desktop 15 SP7
17.38.13-150700.6.13.1
fixed
suse enterprise sap 15 SP7
17.38.13-150700.6.13.1
fixed
suse enterprise server 15 SP4
17.38.13-150400.3.158.1
fixed
suse enterprise server 15 SP5
17.38.13-150500.6.74.1
fixed
suse enterprise server 15 SP6
17.38.13-150600.3.92.1
fixed
suse enterprise server 15 SP7
17.38.13-150700.6.13.1
fixed
perl-solv
suse enterprise server 15 SP4
0.7.39-150400.3.46.1
fixed
suse enterprise server 15 SP5
0.7.39-150500.6.17.1
fixed
suse enterprise server 15 SP6
0.7.39-150600.8.24.1
fixed
python3-solv
suse enterprise desktop 15 SP7
0.7.39-150700.11.10.1
fixed
suse enterprise sap 15 SP7
0.7.39-150700.11.10.1
fixed
suse enterprise server 15 SP4
0.7.39-150400.3.46.1
fixed
suse enterprise server 15 SP5
0.7.39-150500.6.17.1
fixed
suse enterprise server 15 SP6
0.7.39-150600.8.24.1
fixed
suse enterprise server 15 SP7
0.7.39-150700.11.10.1
fixed
python311-solv
suse enterprise server 15 SP6
0.7.39-150600.8.24.1
fixed
ruby-solv
suse enterprise desktop 15 SP7
0.7.39-150700.11.10.1
fixed
suse enterprise sap 15 SP7
0.7.39-150700.11.10.1
fixed
suse enterprise server 15 SP4
0.7.39-150400.3.46.1
fixed
suse enterprise server 15 SP5
0.7.39-150500.6.17.1
fixed
suse enterprise server 15 SP6
0.7.39-150600.8.24.1
fixed
suse enterprise server 15 SP7
0.7.39-150700.11.10.1
fixed
zypper
suse enterprise desktop 15 SP7
1.14.98-150700.13.6.1
fixed
suse enterprise sap 15 SP7
1.14.98-150700.13.6.1
fixed
suse enterprise server 15 SP4
1.14.98-150400.3.104.1
fixed
suse enterprise server 15 SP5
1.14.98-150500.6.45.1
fixed
suse enterprise server 15 SP6
1.14.98-150600.10.55.1
fixed
suse enterprise server 15 SP7
1.14.98-150700.13.6.1
fixed
zypper-log
suse enterprise desktop 15 SP7
1.14.98-150700.13.6.1
fixed
suse enterprise sap 15 SP7
1.14.98-150700.13.6.1
fixed
suse enterprise server 15 SP4
1.14.98-150400.3.104.1
fixed
suse enterprise server 15 SP5
1.14.98-150500.6.45.1
fixed
suse enterprise server 15 SP6
1.14.98-150600.10.55.1
fixed
suse enterprise server 15 SP7
1.14.98-150700.13.6.1
fixed
zypper-needs-restarting
suse enterprise desktop 15 SP7
1.14.98-150700.13.6.1
fixed
suse enterprise sap 15 SP7
1.14.98-150700.13.6.1
fixed
suse enterprise server 15 SP4
1.14.98-150400.3.104.1
fixed
suse enterprise server 15 SP5
1.14.98-150500.6.45.1
fixed
suse enterprise server 15 SP6
1.14.98-150600.10.55.1
fixed
suse enterprise server 15 SP7
1.14.98-150700.13.6.1
fixed
Common Weakness Enumeration
References
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44933