SUSE python310-pip Vulnerability Allows Arbitrary File Write

A moderate vulnerability (CVE-2026-13346) has been identified in python310-pip, affecting openSUSE Leap 15.4. The flaw arises from improper handling of doubly-encoded package URLs from malicious indexes, which can lead to files being installed in arbitrary locations on the disk. This vulnerability has a CVSS score of 4.0, indicating a moderate severity. Users are advised to apply the patch provided by SUSE to mitigate this risk. The vulnerability was published on July 29, 2026, and the patch was released on August 26, 2026. The recommended installation methods include using YaST online_update or the command 'zypper patch'. Failure to apply the patch could expose systems to potential exploitation. The vulnerability affects the python310-pip version 22.0.4 on openSUSE Leap 15.4.

Key Points: • CVE-2026-13346 allows arbitrary file write via malicious package URLs. • Affected systems include openSUSE Leap 15.4 with python310-pip version 22.0.4. • Patch is available; users should update using YaST or 'zypper patch'.