What is GHSA-wp9x-wjhc-28mv?

GHSA-wp9x-wjhc-28mv is a security advisory published by GitHub Security Advisories with High severity. A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38...

Which CVE IDs does GHSA-wp9x-wjhc-28mv cover?

GHSA-wp9x-wjhc-28mv covers the following CVE IDs: CVE-2026-44941. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wp9x-wjhc-28mv?

GHSA-wp9x-wjhc-28mv has a CVSS v3 base score of 8.4, published by GitHub Security Advisories.

GHSA-wp9x-wjhc-28mvHighCVSS 8.4

A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38...

Vendor

GitHub Security Advisories

Published

July 2, 2026

Last Modified

July 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-44941 →

📋 Description

A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious repository to inject or overwrite files in the target system as root.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-44941
https://github.com/openSUSE/libzypp/commit/294b1bad442d089ca671c5c03adc8031e3b29e04
https://bugzilla.suse.com/show_bug.cgi?id=1267426
https://github.com/advisories/GHSA-wp9x-wjhc-28mv