Skip to main content

libzypp EUVDEUVD-2026-40062

| CVE-2026-25707 HIGH
Relative Path Traversal (CWE-23)
2026-06-29 meissner@suse.de GHSA-4h5m-3w75-qcq5
Privilege Escalation Denial Of Service Path Traversal Red Hat Suse Opensuse Libzypp
8.8
CVSS 3.1 · Vendor: suse
Share

Severity by source

Vendor (suse) PRIMARY
8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI
8.8 HIGH

Network-delivered metadata (AV:N) with no attacker auth (PR:N) but mandatory victim repo refresh (UI:R); root-privileged file overwrite yields privesc, so I:H/A:H and C:H via resulting code execution.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.4 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat
8.8 HIGH
qualitative

Primary rating from Vendor (suse).

CVSS VectorVendor: suse

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Patch available
Jun 29, 2026 - 12:01 EUVD
Source Code Evidence Fetched
Jun 29, 2026 - 10:32 vuln.today
Analysis Generated
Jun 29, 2026 - 10:32 vuln.today

DescriptionCVE.org

A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories to overwrite files on the system, leading to denial of service or privilege escalation.

AnalysisAI

Arbitrary file overwrite in libzypp before 17.38.10 lets a remote attacker who controls a software repository plant crafted repository metadata (repomd/SUSE content files) with '../' location paths that escape the repo root, allowing files anywhere on the system to be overwritten when a victim adds and refreshes that repository. Because zypper-based refresh operations typically run as root, this can escalate to privilege escalation or denial of service. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

libzypp is the C++ package-management library underpinning zypper and the SUSE/openSUSE software stack (YaST, PackageKit backends). The flaw is a CWE-23 relative path traversal in the metadata parsers: RepomdFileReader.cc (YUM 'repomd.xml' <location href> attributes) and susetags/ContentFileReader.cc (descrdir/datadir directives and per-file HASH entries). These parsers took attacker-supplied href/path values and used them verbatim to compute download/storage locations, so a value like '../hostile/...' resolved to a path outside the repository cache. The vendor fix introduces sanitize()/sanitizeEntry() helpers that call Pathname::absolutename() and Pathname::relativeDotDot() to detect and discard entries that point outside the repo root, logging a 'hostile location' warning instead of writing the file.

RemediationAI

Vendor-released patch: 17.38.10 - upgrade libzypp to 17.38.10 or later via your SUSE/openSUSE update channel as the primary fix (commit f09feda7fca03c941218aab0bb161cc82b185b6b adds path sanitization that discards metadata entries resolving outside the repo root). Until patched, the most effective compensating control is to only add and refresh repositories from trusted, vendor-signed sources and to enforce repository GPG signature checking and HTTPS transport so attacker-supplied or MITM'd metadata cannot be introduced (trade-off: blocks use of unsigned/internal mirrors and may break workflows relying on plain-HTTP mirrors). Avoid running 'zypper refresh/install' against untrusted third-party repositories, and where feasible restrict which accounts/automation can modify the repository list (trade-off: tighter change control on repo configuration). Track the SUSE advisory at https://bugzilla.suse.com/show_bug.cgi?id=1259802 for distribution-specific fixed package versions.

More in Opensuse

View all
CVE-2015-5119 CRITICAL POC
9.8 Jul 08

Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
CVE-2016-4117 CRITICAL POC
9.8 May 11

Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
CVE-2015-3113 CRITICAL POC
9.8 Jun 23

Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
CVE-2011-0611 HIGH POC
8.8 Apr 13

Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
CVE-2012-1823 CRITICAL POC
9.8 May 11

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
CVE-2013-0422 CRITICAL POC
9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
CVE-2014-0497 CRITICAL POC
9.8 Feb 05

Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
CVE-2009-4324 HIGH POC
7.8 Dec 15

Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
CVE-2015-0313 CRITICAL POC
9.8 Feb 02

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows

CVE-2015-5122 CRITICAL POC
9.8 Jul 14

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
CVE-2011-0609 HIGH POC
7.8 Mar 15

Adobe Flash Player 10.2 and earlier across all platforms contain an unspecified vulnerability allowing remote code execu

Same weakness CWE-23 – Relative Path Traversal

View all
CVE-2025-64446 CRITICAL POC
9.8
CVE-2024-27199 HIGH POC
7.3
CVE-2025-34510 HIGH POC
8.8
CVE-2026-34926 MEDIUM POC
6.7
CVE-2024-24578 CRITICAL POC
9.8
CVE-2025-52207 CRITICAL POC
9.9
CVE-2023-6825 CRITICAL POC
9.9
CVE-2022-1373 HIGH POC
7.2

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/ltss/sle15.4/sle15:15.4-6.29 Container suse/manager/4.3/proxy-httpd:4.3.18.9.79.16 Container suse/manager/4.3/proxy-salt-broker:4.3.18.9.69.16 Container suse/sle-micro-rancher/5.3:latest Container suse/sle-micro-rancher/5.4:5.4.4.5.138 Container suse/sle-micro/5.3/toolbox:16.3-6.11.242 Container suse/sle-micro/5.4/toolbox:16.3-5.19.243 Image SLES15-SP4-CHOST-BYOS Image SLES15-SP4-CHOST-BYOS-Aliyun Image SLES15-SP4-CHOST-BYOS-Azure Image SLES15-SP4-CHOST-BYOS-EC2 Image SLES15-SP4-CHOST-BYOS-GCE Image SLES15-SP4-CHOST-BYOS-SAP-CCloud Affected
Container suse/ltss/sle15.5/sle15:15.5-8.46 Container suse/sle-micro/5.5/toolbox:16.3-3.12.150 Container suse/sle-micro/base-5.5:2.0.4-5.8.285 Affected
Container suse/ltss/sle15.6/sle15:15.6-5.66 Affected
Container suse/multi-linux-manager/5.1/x86_64/proxy-httpd:5.1.4.8.24.2 Container suse/multi-linux-manager/5.1/x86_64/proxy-salt-broker:5.1.4.9.22.2 Container suse/sle15:15.7-5.20.31 Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2-ECS-HVM Affected
Container suse/multi-linux-manager/5.1/x86_64/server-saline:5.1.4.9.22.1 Image proxy-salt-broker-image Image server-saline-image Affected

Share

EUVD-2026-40062 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy