CVE-2026-44941: libzypp Path Traversal Vulnerability – File Overwrite as Root

Technical summary

CVE-2026-44941 is a relative path traversal vulnerability (CWE-23) in libzypp versions prior to 17.38.12. The flaw occurs during repomd.xml parsing when the 'keyhint' option is processed. Insufficient path normalization permits an attacker to supply a specially crafted keyhint value containing relative path components (e.g., '../') that, when resolved by the package manager, reference files outside the intended repository directory. Because libzypp operations run with root privileges, successful traversal results in arbitrary file write capabilities on the system. The vulnerability requires an attacker to provision a malicious repository and convince or manipulate a user into adding it to their system configuration.

Business impact

Organizations relying on openSUSE systems or applications using libzypp face a critical supply-chain risk. A compromised or attacker-controlled repository could result in system-wide file corruption, installation of malicious binaries, overwriting of configuration files, or privilege escalation paths. For enterprises managing multiple openSUSE deployments, a single malicious repository injected into a shared package management infrastructure could compromise dozens or hundreds of endpoints. The attack surface widens in environments where repository configuration is centralized or where users have latitude to add third-party repositories.

Affected systems

The vulnerability affects openSUSE systems running libzypp versions before 17.38.12. This includes openSUSE Leap, Tumbleweed, and SUSE Linux Enterprise distributions that depend on libzypp for package management. Any system or application that embeds or calls libzypp's repository parsing functions is potentially affected. Verify your installed version against the vendor advisory to confirm exposure.

Exploitability

Exploitation has moderate barriers. An attacker must first establish or compromise a repository that a target system will access, and a user or automated process must add that repository to the system's configuration. However, once those conditions are met, the attack is reliable and does not require additional user interaction beyond the initial repository configuration. The CVSS vector indicates network-accessible attack, high privilege (repository admin), but requires user interaction (repository configuration). Given that automated repository management and third-party repository usage are common in Linux environments, the practical exploitability is meaningful.

Remediation

Upgrade libzypp to version 17.38.12 or later on all affected systems. This patch version includes validation improvements to the keyhint option and path normalization logic. After patching, audit all configured repositories—particularly third-party and community-maintained sources—to ensure they are legitimate and from trusted upstream sources. Consider restricting which repositories can be added and by whom in centrally managed environments.

Patch guidance

Obtain and apply libzypp version 17.38.12 or newer through your distribution's standard package management channels. For openSUSE Leap users, check the official openSUSE security advisories for the specific package release. For Tumbleweed, the patch should be available in the rolling release stream. Verify against the vendor advisory that the installed version matches or exceeds 17.38.12. After patching, restart any services or processes that depend on libzypp (typically package manager operations and any applications invoking repomd.xml parsing directly).

Detection guidance

Monitor system logs for unusual repository configuration changes, particularly additions of unfamiliar or external repositories. In centralized environments, audit repository configurations against approved whitelists. Watch for unexpected file modifications in system directories that coincide with package manager activity or repository metadata updates. Network monitoring for connections to unusual or suspicious package repositories may provide early warning. If a malicious repository was briefly active, file integrity monitoring (FIM) tools can help identify any injected or overwritten files for recovery or forensic analysis.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH severity rating, root-level impact, and the broad distribution of libzypp across openSUSE and SUSE systems. Although exploitation requires repository compromise and user configuration changes, the consequences of successful exploitation—arbitrary file writes as root—are catastrophic. In supply-chain-sensitive environments or organizations with open repository policies, this should be treated as a critical patch. The absence from CISA's KEV catalog does not diminish the urgency, as active exploitation may emerge quickly once details are public.

Risk score, explained

The CVSS 3.1 score of 8.4 (HIGH) reflects a network-accessible vulnerability with low attack complexity, high impact across confidentiality, integrity, and availability, and a broad scope (systems other than the vulnerable component may be affected). The requirement for high privilege and user interaction prevents a critical rating, but the root-level file write capability and system-wide consequences justify the HIGH band. For environments where third-party repositories are common or automated, effective risk may be higher than the base score suggests.

Frequently asked questions