CVE-2026-44941 — libzypp path traversal via "keyhint" in repomd.xml
A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious repository to inject or ov…
Published: 2026-07-02 · CVSS: 8.4 · CVSS 3.1
A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious repository to inject or overwrite files in the target system as root.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7