CVE-2026-44942

{
  "id": "CVE-2026-44942",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-18T14:17:25.903",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A path traversal in handling the \"path\" component of .repo files processed by libzypp before 17.38.13 in the 17.x series, or before 16.22.19 could be used by attackers to fill directories on the system outside of the zypp cache with content."
    },
    {
      "lang": "es",
      "value": "Un salto de ruta en el manejo del componente ’path’ de archivos .repo procesados por libzypp antes de la versión 17.38.13 en la serie 17.x, o antes de la 16.22.19 podría ser utilizado por atacantes para llenar directorios en el sistema fuera de la caché de zypp con contenido."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "SUSE",
          "product": "libzypp",
          "defaultStatus": "unaffected",
          "packageName": "libzypp",
          "modules": [
            "repo parsing"
          ],
          "repo": "https://github.com/opensuse/libzypp",
          "versions": [
            {
              "version": "17.0.0",
              "lessThan": "17.38.13",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "16.22.19",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-18T12:05:47.827082Z",
          "id": "CVE-2026-44942",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-24"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=1267874",
      "source": "[email protected]"
    },
    {
      "url": "https://www.suse.com/security/cve/CVE-2026-44942.html",
      "source": "[email protected]"
    }
  ]
}