CVE-2026-25707: Handcrafted repo metadata may cause arbitrary local files to be overwritten by libzypp

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-29 · updated 2026-10-25
Weakness: CWE-23

Description

A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories to overwrite files on the system, leading to denial of service or privilege escalation.

Affected products

SUSE libzypp: before 17.38.10 — fixed in 17.38.10

How to fix

Upgrade to a fixed version: SUSE libzypp 17.38.10. Check the vendor advisory for mitigations.

References

https://bugzilla.suse.com/show_bug.cgi?id=1259802
https://github.com/openSUSE/libzypp/commit/f09feda7fca03c941218aab0bb161cc82b185b6b

Get alerted when CVE-2026-25707 or the next vulnerability affects your stack