CVE-2026-104620

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-104620", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "state": "PUBLISHED", "assignerShortName": "suse", "dateReserved": "2026-10-02T04:18:56.078Z", "datePublished": "2026-11-09T14:31:16.701Z", "dateUpdated": "2026-11-10T04:56:00.882Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-11-09T14:31:16.701Z"}, "title": "PackageKit/ZYpp local privilege escalation using InstallFiles(SIMULATE)", "datePublic": "2026-11-09T14:22:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-23", "description": "CWE-23 Relative path traversal", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "affected": [{"vendor": "PackageKit", "product": "PackageKit", "packageName": "PackageKit", "repo": "https://github.com/PackageKit/PackageKit", "modules": ["Zypp Backend"], "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.1", "versionType": "rpm"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:packagekit:packagekit:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "1.4.1"}]}]}], "descriptions": [{"lang": "en", "value": "A path traversal attack in simulation of actions in the Zypp backend of PackageKit before 1.4.1 could be used by local attackers to gain root privileges.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A path traversal attack in simulation of actions in the Zypp backend of PackageKit before 1.4.1 could be used by local attackers to gain root privileges."}]}], "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=1284954", "tags": ["issue-tracking"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "PROOF_OF_CONCEPT", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.5, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P"}}], "credits": [{"lang": "en", "value": "Adam `adamm` Simuntis", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-104620"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T04:56:00.882Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-104620", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-09T15:32:50.490737Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T16:20:08.590Z"}}], "cna": {"title": "PackageKit/ZYpp local privilege escalation using InstallFiles(SIMULATE)", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Adam `adamm` Simuntis"}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/PackageKit/PackageKit", "vendor": "PackageKit", "modules": ["Zypp Backend"], "product": "PackageKit", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.1", "versionType": "rpm"}], "packageName": "PackageKit", "defaultStatus": "unaffected"}], "datePublic": "2026-11-09T14:22:00.000Z", "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=1284954", "tags": ["issue-tracking"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "A path traversal attack in simulation of actions in the Zypp backend of PackageKit before 1.4.1 could be used by local attackers to gain root privileges.", "supportingMedia": [{"type": "text/html", "value": "A path traversal attack in simulation of actions in the Zypp backend of PackageKit before 1.4.1 could be used by local attackers to gain root privileges.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-23", "description": "CWE-23 Relative path traversal"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:packagekit:packagekit:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.4.1", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-11-09T14:31:16.701Z"}}}, "cveMetadata": {"cveId": "CVE-2026-104620", "state": "PUBLISHED", "dateUpdated": "2026-11-09T16:20:11.884Z", "dateReserved": "2026-10-02T04:18:56.078Z", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "datePublished": "2026-11-09T14:31:16.701Z", "assignerShortName": "suse"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["Zypp Backend"], "packageName": "PackageKit", "product": "PackageKit", "repo": "https://github.com/PackageKit/PackageKit", "vendor": "PackageKit", "versions": [{"lessThan": "1.4.1", "status": "affected", "version": "0", "versionType": "rpm"}]}], "source": "meissner@suse.de"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A path traversal attack in simulation of actions in the Zypp backend of PackageKit before 1.4.1 could be used by local attackers to gain root privileges."}], "id": "CVE-2026-104620", "lastModified": "2026-11-12T19:02:35.830", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "meissner@suse.de", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-104620", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-11-09T15:17:04.997", "references": [{"source": "meissner@suse.de", "url": "https://bugzilla.suse.com/show_bug.cgi?id=1284954"}], "sourceIdentifier": "meissner@suse.de", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-23"}], "source": "meissner@suse.de", "type": "Secondary"}]}

{"bugzilla": {"description": "PackageKit: PackageKit: Privilege escalation via path traversal in the Zypp backend", "id": "2569622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2569622"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-22", "details": ["A path traversal attack in simulation of actions in the Zypp backend of PackageKit before 1.4.1 could be used by local attackers to gain root privileges.", "A flaw was found in PackageKit. A path traversal vulnerability during action simulation in the Zypp backend allows a local attacker to manipulate file paths. This issue can be exploited by an unprivileged local user to achieve privilege escalation and gain root access to the system."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-104620", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "PackageKit", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Not affected", "package_name": "PackageKit", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "compat-PackageKit08", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "PackageKit", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "PackageKit", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "PackageKit", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-11-09T14:31:16Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-104620\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-104620\nhttps://bugzilla.suse.com/show_bug.cgi?id=1284954"], "statement": "This vulnerability is rated as Important because an unprivileged local user could gain full administrative control over the host, posing a severe threat to system confidentiality and integrity. In typical Red Hat deployments, PackageKit utilizes the DNF backend and does not compile or ship the Zypp backend. Consequently, standard Red Hat Enterprise Linux environments are not exposed to the vulnerable backend code.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.1)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "PackageKit", "source": "cna", "vendor": "PackageKit"}, "product": "packagekit", "vendor": "packagekit"}], "created": "2026-11-09T15:15:11.210406+00:00", "updated": "2026-11-09T15:30:08.615571+00:00", "vendors": ["packagekit", "packagekit$PRODUCT$packagekit"]}