CVE-2026-44941

Name	CVE-2026-44941
Description	A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious repository to inject or overwrite files in the target system as root.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libzypp (PTS)	bullseye	17.25.7-1	vulnerable
	bookworm	17.25.7-2.4	vulnerable
	trixie	17.36.7-1	vulnerable
	forky, sid	17.38.14-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libzypp	source	(unstable)	17.38.12-1

Fixed by: https://github.com/openSUSE/libzypp/commit/294b1bad442d089ca671c5c03adc8031e3b29e04 (17.38.12)