CVE-2026-44942

Medium

Description

A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x series, or before 16.22.19 could be used by attackers to fill directories on the system outside of the zypp cache with content.

SeverityMedium

CVSS6.5

Exploit probability—

Product

Suse Libzypp

PublishedJun 18, 2026

First seenJun 18, 2026

Weakness typeCWE-24CWE-24

How to fix

Update

SUSE libzypp17.38.13, 16.22.19 or later

Vendor advisories

suse.com/security/cve/CVE-2026-44942.html

Affected products

Product	Affected versions	Fixed in
SUSE libzypp	17.0.0 ≤ v < 17.38.13, v < 16.22.19	17.38.13, 16.22.19

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.