Path traversal in Rollup - CVE-2026-27606

Vulnerability identifier: #VU123174

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-27606

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences within the Rollup module bundler. A remote attacker can send a specially crafted HTTP request and write arbitrary files on the system, leading to arbitrary code execution.

Rollup
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Multi-Linux Manager Beta Client Tools for SLE Micro
SUSE Linux Enterprise Micro
SUSE Manager Client Tools for SLE Micro
SUSE Multi-Linux Manager Beta Client Tools for SLE
SUSE Manager Client Tools for SLE
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
Basesystem Module
SUSE Package Hub 15
openSUSE Leap
Jira Software Data Center
Jira Service Management Data Center
mgrctl
mgrctl-lang
mgrctl-debuginfo
mgrctl-zsh-completion
mgrctl-bash-completion
firewalld-prometheus-config
dracut-wireless
golang-github-QubitProducts-exporter_exporter
python3-defusedxml
prometheus-postgres_exporter-debuginfo
prometheus-postgres_exporter
golang-github-prometheus-promu-debuginfo
golang-github-prometheus-promu
prometheus-blackbox_exporter
golang-github-prometheus-alertmanager-debuginfo
golang-github-prometheus-alertmanager
golang-github-lusitaniae-apache_exporter
golang-github-lusitaniae-apache_exporter-debuginfo
dracut-saltboot
supportutils-plugin-salt
golang-github-prometheus-node_exporter-debuginfo
golang-github-prometheus-node_exporter
golang-github-boynux-squid_exporter-debuginfo
golang-github-boynux-squid_exporter
golang-github-prometheus-prometheus
golang-github-prometheus-prometheus-debuginfo
release-notes-susemanager-proxy
release-notes-susemanager
spacecmd
supportutils-plugin-susemanager-client
mgr-push
python3-uyuni-common-libs
python3-mgr-push
spacewalk-client-tools
python3-rhnlib
python3-spacewalk-client-tools
Multi-Linux-ManagerTools-Beta-SLE-Micro-release
grafana-debuginfo
grafana
venv-salt-minion

Install updates from vendor's website.

Rollup - addressed in versions 2.80.0, 3.30.0, 4.59.0
Jira Software Data Center - update to 11.3.9
Jira Service Management Data Center - update to 11.3.10
mgrctl - addressed in versions 0.1.38-150000.1.30.1, 5.2.5-159000.2.3.2
mgrctl-lang - addressed in versions 0.1.38-150000.1.30.1, 5.2.5-159000.2.3.2
mgrctl-debuginfo - addressed in versions 0.1.38-150000.1.30.1, 5.2.5-159000.2.3.2
mgrctl-zsh-completion - addressed in versions 0.1.38-150000.1.30.1, 5.2.5-159000.2.3.2
mgrctl-bash-completion - addressed in versions 0.1.38-150000.1.30.1, 5.2.5-159000.2.3.2
firewalld-prometheus-config - addressed in versions 0.1-150000.3.67.1, 0.1-159000.4.3.2
dracut-wireless - update to 0.1.1595937550.0285244-159000.2.2.1
golang-github-QubitProducts-exporter_exporter - addressed in versions 0.4.0-150000.1.21.1, 0.4.0-159000.2.2.1
python3-defusedxml - update to 0.7.1-159000.4.2.1
prometheus-postgres_exporter-debuginfo - update to 0.10.1-159000.2.2.1
prometheus-postgres_exporter - update to 0.10.1-159000.2.2.1
golang-github-prometheus-promu-debuginfo - update to 0.17.0-150000.3.30.1
golang-github-prometheus-promu - update to 0.17.0-150000.3.30.1
prometheus-blackbox_exporter - addressed in versions 0.26.0-150000.1.30.2, 0.26.0-159000.2.2.1
golang-github-prometheus-alertmanager-debuginfo - update to 0.28.1-159000.12.2.1
golang-github-prometheus-alertmanager - update to 0.28.1-159000.12.2.1
golang-github-lusitaniae-apache_exporter - addressed in versions 1.0.10-150000.1.26.1, 1.0.10-159000.2.2.1
golang-github-lusitaniae-apache_exporter-debuginfo - addressed in versions 1.0.10-150000.1.26.1, 1.0.10-159000.2.2.1
dracut-saltboot - addressed in versions 1.1.0-150000.1.65.1, 1.1.0-159000.2.2.1
supportutils-plugin-salt - update to 1.2.3-159000.4.2.1
golang-github-prometheus-node_exporter-debuginfo - addressed in versions 1.9.1-159000.4.2.1, 1.10.2-150100.3.42.1
golang-github-prometheus-node_exporter - addressed in versions 1.9.1-159000.4.2.1, 1.10.2-150100.3.42.1
golang-github-boynux-squid_exporter-debuginfo - addressed in versions 1.13.0-150000.1.12.1, 1.13.0-159000.2.2.1
golang-github-boynux-squid_exporter - addressed in versions 1.13.0-150000.1.12.1, 1.13.0-159000.2.2.1
golang-github-prometheus-prometheus - addressed in versions 3.5.0-150000.3.67.1, 3.5.0-159000.4.3.2, 3.5.3-150100.4.34.1
golang-github-prometheus-prometheus-debuginfo - addressed in versions 3.5.0-159000.4.3.2, 3.5.3-150100.4.34.1
release-notes-susemanager-proxy - update to 4.3.18-150400.3.110.2
release-notes-susemanager - update to 4.3.18-150400.3.154.2
spacecmd - addressed in versions 5.0.15-150000.3.142.1, 5.2.6-159000.4.3.1
supportutils-plugin-susemanager-client - update to 5.2.2-159000.4.2.1
mgr-push - update to 5.2.3-159000.2.3.1
python3-uyuni-common-libs - update to 5.2.3-159000.2.3.1
python3-mgr-push - update to 5.2.3-159000.2.3.1
spacewalk-client-tools - update to 5.2.4-159000.4.3.1
python3-rhnlib - update to 5.2.4-159000.4.3.1
python3-spacewalk-client-tools - update to 5.2.4-159000.4.3.1
Multi-Linux-ManagerTools-Beta-SLE-Micro-release - update to 5-159000.3.3.1
grafana-debuginfo - addressed in versions 11.6.11-150000.1.90.1, 11.6.11-159000.2.3.2
grafana - addressed in versions 11.6.11-150000.1.90.1, 11.6.11-159000.2.3.2
venv-salt-minion - update to 3006.0-159000.5.3.2

• Exploit #12435 - Arbitrary File Write via Path Traversal in Rollup 4 (February 24, 2026)

• https://github.com/rollup/rollup/security/advisories/GHSA-mw96-cpmx-2vgc

• Path traversal in Rollup
• SUSE update for Security update 5.0.7 for Multi-Linux Manager Client Tools
• SUSE update for Security Beta update 5.2.0 Beta1 for Multi-Linux Manager Client Tools
• SUSE update for Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes
• SUSE update for golang-github-prometheus-prometheus
• Multiple vulnerabilities in Jira Service Management Data Center
• Multiple vulnerabilities in Jira Software Data Center