CVE-2026-44942

EUVD-2026-37871
A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x series, or before 16.22.19 could be used by attackers to fill directories on the system outside of the zypp cache with content.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 34%
Debian logo
Debian Releases
Debian Product
Codename
libzypp
bookworm
postponed
bullseye
postponed
forky
17.38.14-1
fixed
sid
17.38.14-1
fixed
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libzypp
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
needs-triage
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libsolv-devel
suse enterprise desktop 15 SP7
0.7.39-150700.11.10.1
fixed
suse enterprise sap 15 SP7
0.7.39-150700.11.10.1
fixed
suse enterprise server 15 SP4
0.7.39-150400.3.46.1
fixed
suse enterprise server 15 SP5
0.7.39-150500.6.17.1
fixed
suse enterprise server 15 SP6
0.7.39-150600.8.24.1
fixed
suse enterprise server 15 SP7
0.7.39-150700.11.10.1
fixed
libsolv-tools
suse enterprise desktop 15 SP7
0.7.39-150700.11.10.1
fixed
suse enterprise sap 15 SP7
0.7.39-150700.11.10.1
fixed
suse enterprise server 15 SP4
0.7.39-150400.3.46.1
fixed
suse enterprise server 15 SP5
0.7.39-150500.6.17.1
fixed
suse enterprise server 15 SP6
0.7.39-150600.8.24.1
fixed
suse enterprise server 15 SP7
0.7.39-150700.11.10.1
fixed
libsolv-tools-base
suse enterprise desktop 15 SP7
0.7.39-150700.11.10.1
fixed
suse enterprise sap 15 SP7
0.7.39-150700.11.10.1
fixed
suse enterprise server 15 SP4
0.7.39-150400.3.46.1
fixed
suse enterprise server 15 SP5
0.7.39-150500.6.17.1
fixed
suse enterprise server 15 SP6
0.7.39-150600.8.24.1
fixed
suse enterprise server 15 SP7
0.7.39-150700.11.10.1
fixed
libzypp
suse enterprise desktop 15 SP7
17.38.13-150700.6.13.1
fixed
suse enterprise sap 15 SP7
17.38.13-150700.6.13.1
fixed
suse enterprise server 12 SP3
16.22.19-82.1
fixed
suse enterprise server 12 SP5
16.22.19-82.1
fixed
suse enterprise server 15 SP4
17.38.13-150400.3.158.1
fixed
suse enterprise server 15 SP5
17.38.13-150500.6.74.1
fixed
suse enterprise server 15 SP6
17.38.13-150600.3.92.1
fixed
suse enterprise server 15 SP7
17.38.13-150700.6.13.1
fixed
libzypp-devel
suse enterprise desktop 15 SP7
17.38.13-150700.6.13.1
fixed
suse enterprise sap 15 SP7
17.38.13-150700.6.13.1
fixed
suse enterprise server 12 SP3
16.22.19-82.1
fixed
suse enterprise server 12 SP5
16.22.19-82.1
fixed
suse enterprise server 15 SP4
17.38.13-150400.3.158.1
fixed
suse enterprise server 15 SP5
17.38.13-150500.6.74.1
fixed
suse enterprise server 15 SP6
17.38.13-150600.3.92.1
fixed
suse enterprise server 15 SP7
17.38.13-150700.6.13.1
fixed
libzypp-devel-doc
suse enterprise server 12 SP5
16.22.19-82.1
fixed
perl-solv
suse enterprise server 15 SP4
0.7.39-150400.3.46.1
fixed
suse enterprise server 15 SP5
0.7.39-150500.6.17.1
fixed
suse enterprise server 15 SP6
0.7.39-150600.8.24.1
fixed
python3-solv
suse enterprise desktop 15 SP7
0.7.39-150700.11.10.1
fixed
suse enterprise sap 15 SP7
0.7.39-150700.11.10.1
fixed
suse enterprise server 15 SP4
0.7.39-150400.3.46.1
fixed
suse enterprise server 15 SP5
0.7.39-150500.6.17.1
fixed
suse enterprise server 15 SP6
0.7.39-150600.8.24.1
fixed
suse enterprise server 15 SP7
0.7.39-150700.11.10.1
fixed
python311-solv
suse enterprise server 15 SP6
0.7.39-150600.8.24.1
fixed
ruby-solv
suse enterprise desktop 15 SP7
0.7.39-150700.11.10.1
fixed
suse enterprise sap 15 SP7
0.7.39-150700.11.10.1
fixed
suse enterprise server 15 SP4
0.7.39-150400.3.46.1
fixed
suse enterprise server 15 SP5
0.7.39-150500.6.17.1
fixed
suse enterprise server 15 SP6
0.7.39-150600.8.24.1
fixed
suse enterprise server 15 SP7
0.7.39-150700.11.10.1
fixed
zypper
suse enterprise desktop 15 SP7
1.14.98-150700.13.6.1
fixed
suse enterprise sap 15 SP7
1.14.98-150700.13.6.1
fixed
suse enterprise server 15 SP4
1.14.98-150400.3.104.1
fixed
suse enterprise server 15 SP5
1.14.98-150500.6.45.1
fixed
suse enterprise server 15 SP6
1.14.98-150600.10.55.1
fixed
suse enterprise server 15 SP7
1.14.98-150700.13.6.1
fixed
zypper-log
suse enterprise desktop 15 SP7
1.14.98-150700.13.6.1
fixed
suse enterprise sap 15 SP7
1.14.98-150700.13.6.1
fixed
suse enterprise server 15 SP4
1.14.98-150400.3.104.1
fixed
suse enterprise server 15 SP5
1.14.98-150500.6.45.1
fixed
suse enterprise server 15 SP6
1.14.98-150600.10.55.1
fixed
suse enterprise server 15 SP7
1.14.98-150700.13.6.1
fixed
zypper-needs-restarting
suse enterprise desktop 15 SP7
1.14.98-150700.13.6.1
fixed
suse enterprise sap 15 SP7
1.14.98-150700.13.6.1
fixed
suse enterprise server 15 SP4
1.14.98-150400.3.104.1
fixed
suse enterprise server 15 SP5
1.14.98-150500.6.45.1
fixed
suse enterprise server 15 SP6
1.14.98-150600.10.55.1
fixed
suse enterprise server 15 SP7
1.14.98-150700.13.6.1
fixed
Common Weakness Enumeration
References
https://bugzilla.suse.com/show_bug.cgi?id=1267874
https://www.suse.com/security/cve/CVE-2026-44942.html