{"id":"CVE-2026-104620","kind":"vulnerability","aliases":["CVE-2026-104620"],"related":[],"title":"PackageKit: path traversal in Zypp backend lets local users gain root","description":"A path traversal attack in simulation of actions in the Zypp backend of PackageKit before 1.4.1 could be used by local attackers to gain root privileges.","summary":"PackageKit's Zypp backend has a path traversal flaw in its action simulation code before version 1.4.1. A local user can use it to gain root privileges on the machine.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"PackageKit","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","linux","opensuse","packagekit","suse","zypp"],"not_affected_if":["no-packagekit","no-zypp-backend"],"how_to_check":"- Check the installed PackageKit version with `pkcon --version` or `packagekitd --version`, and confirm the Zypp backend is present (`rpm -q PackageKit-backend-zypp` or `dpkg -l | grep packagekit`)","fix":"- PackageKit: move to `1.4.1` or later\n- Other products: unknown","status":"open","published_at":"2026-11-09T15:17:04+00:00","first_seen_at":"2026-11-09T15:27:06+00:00","triaged_at":"2026-11-09T15:28:05+00:00","updated_at":"2026-11-09T15:28:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-09T15:28:05Z","model":"claude-haiku-5-5","output":{"fix":"- PackageKit: move to `1.4.1` or later\n- Other products: unknown","reach":"local","title":"PackageKit: path traversal in Zypp backend lets local users gain root","impact":"high","summary":"PackageKit's Zypp backend has a path traversal flaw in its action simulation code before version 1.4.1. A local user can use it to gain root privileges on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["packagekit","zypp","linux","opensuse","suse"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"local user gains root privileges on the machine","analyst_note":"Confirm affected version range and the fix commit or advisory for the Zypp backend at https://nvd.nist.gov/vuln/detail/CVE-2026-104620; sources give only 'before 1.4.1'.","how_to_check":"- Check the installed PackageKit version with `pkcon --version` or `packagekitd --version`, and confirm the Zypp backend is present (`rpm -q PackageKit-backend-zypp` or `dpkg -l | grep packagekit`)\n- unknown for anything beyond this, since the sources do not say","plain_action":"","product_name":"PackageKit","needs_analyst":true,"not_affected_if":["no-packagekit","no-zypp-backend"],"who_is_affected":"Systems running PackageKit with the Zypp backend, which is used on openSUSE and SUSE Linux installs, are exposed to local privilege escalation. Multi-user Linux hosts and shared workstations carry the most risk, since any local account could exploit it. Machines without PackageKit or without the Zypp backend can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000773,"input_tokens":4508,"output_tokens":644,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-104620':14A,17A '-2026':13A,16A '1.4.1':41B,70C 'action':36B,62C 'attack':58C,76C 'backend':6A,28B,66C 'code':38B 'could':71C 'cve':12A,15A 'flaw':33B 'gain':10A,49B,78C 'infrastructur':19B 'let':7A 'linux':20B 'local':8A,43B,75C 'machin':54B 'opensus':21B 'packagekit':1A,18A,22B,25B,68C 'path':2A,31B,56C 'privileg':51B,80C 'root':11A,50B,79C 'simul':37B,60C 'suse':23B 'travers':3A,32B,57C 'use':46B,73C 'user':9A,44B 'version':40B 'zypp':5A,24B,27B,65C","nicknames":[],"mitigations":[],"who_affected":"Systems running PackageKit with the Zypp backend, which is used on openSUSE and SUSE Linux installs, are exposed to local privilege escalation. Multi-user Linux hosts and shared workstations carry the most risk, since any local account could exploit it. Machines without PackageKit or without the Zypp backend can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["packagekit"],"ptokens":["packagekit"],"labels":["high","infrastructure","linux","opensuse","packagekit","suse","vendor","zypp"],"campaign_type":null,"search_a":"'-104620':14A,17A '-2026':13A,16A 'backend':6A 'cve':12A,15A 'gain':10A 'let':7A 'local':8A 'packagekit':1A,18A 'path':2A 'root':11A 'travers':3A 'user':9A 'zypp':5A","search_b":"'1.4.1':41B 'action':36B 'backend':28B 'code':38B 'flaw':33B 'gain':49B 'infrastructur':19B 'linux':20B 'local':43B 'machin':54B 'opensus':21B 'packagekit':22B,25B 'path':31B 'privileg':51B 'root':50B 'simul':37B 'suse':23B 'travers':32B 'use':46B 'user':44B 'version':40B 'zypp':24B,27B","search_c":"'1.4.1':70C 'action':62C 'attack':58C,76C 'backend':66C 'could':71C 'gain':78C 'local':75C 'packagekit':68C 'path':56C 'privileg':80C 'root':79C 'simul':60C 'travers':57C 'use':73C 'zypp':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T15:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"meissner@suse.de","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104620","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104620","severity":null,"published_at":"2026-11-09T15:17:04+00:00","modified_at":"2026-11-09T15:17:04+00:00","first_seen_at":"2026-11-09T15:27:06+00:00","fetched_at":"2026-11-09T15:27:06+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}