A path traversal flaw exists in the simulation of the InstallFiles function in the Zypp backend of PackageKit versions before 1.4.1. The flaw allows an attacker who can already run commands as a regular unprivileged user on the system to craft a simulated install request that references arbitrary file paths. When executed, the PackageKit service resolves these paths without proper validation, enabling the attacker to read or overwrite system files. This can lead to execution of malicious code or system compromise with full root privileges.

The vulnerability affects the PackageKit component on Linux distributions that ship with PackageKit versions earlier than 1.4.1. Users running the default package management service via ZYpp on such systems are susceptible, regardless of which distribution they use.

The CVSS score of 8.5 indicates a high severity. The EPSS score is not available, and the vulnerability is not currently listed in CISA’s KEV catalog. Because the flaw requires local user access and operates in a simulated mode, the attack vector is local. While the lack of a publicly known automated exploit reduces immediate risk, the potential for local privilege escalation means that any attacker with local access could become root. Current mitigations rely on applying the security update.