Path Traversal Vulnerability in PackageKit Backend by SUSE
CVE-2026-104620

8.5HIGH

Key Information:

Vendor

Packagekit

Status
Packagekit
Vendor
CVE Published:
9 November 2026

What is CVE-2026-104620?

A path traversal vulnerability exists in the Zypp backend of PackageKit prior to version 1.4.1, which allows local attackers to bypass access controls and perform unauthorized actions. This weakness can be leveraged to gain root privileges on affected systems, potentially leading to a full system compromise.

Affected Version(s)

PackageKit 0 < 1.4.1

References

https://bugzilla.suse.com/show_bug.cgi?id=1284954
issue-tracking

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adam `adamm` Simuntis
.