DEBIAN-CVE-2026-44941

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-44941

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44941.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-44941

Upstream

CVE-2026-44941

Published

2026-07-02T16:16:30Z

Modified

2026-09-14T17:03:13Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious repository to inject or overwrite files in the target system as root.

References

https://security-tracker.debian.org/tracker/CVE-2026-44941

Affected packages

Debian:13 / libzypp

Package

Name: libzypp
Purl: pkg:deb/debian/libzypp?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

17.*

17.36.7-1

17.37.16-1

17.37.17-1

17.37.18-1

17.38.1-1

17.38.2-1

17.38.3-1

17.38.4-1

17.38.5-1

17.38.6-1

17.38.7-1

17.38.8-1

17.38.9-1

17.38.11-1

17.38.12-1

17.38.13-1

17.38.13-1+sparc64

17.38.14-1

17.38.15-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44941.json"

Debian:14 / libzypp