High severity · published Jun 29, 2026
CVE-2026-25707
Handcrafted repo metadata may cause arbitrary local files to be overwritten by libzypp
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories to overwrite files on the system, leading to denial of service or privilege escalation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
libzypp · SUSE
before 17.38.10 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25707
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25707
Issue Tracking
https://bugzilla.suse.com/show_bug.cgi?id=1259802
Patch
https://github.com/openSUSE/libzypp/commit/f09feda7fca03c941218aab0bb161cc82b185b6b
More from libzypp
8.8
CVE-2026-44941
libzypp path traversal via "keyhint" in repomd.xml
6.5
CVE-2026-44942
libzypp .repo files can have an optional path which can lead to path traversal attacks