Skip to main content

libzypp EUVDEUVD-2026-40062

| CVE-2026-25707 HIGH
Relative Path Traversal (CWE-23)
2026-06-29 meissner@suse.de GHSA-4h5m-3w75-qcq5
Privilege Escalation Denial Of Service Path Traversal Opensuse Libzypp
8.8
CVSS 3.1 · Vendor: suse
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Host or MITM a malicious repository
  2. Delivery
    Publish metadata with '../' location path
  3. Exploit
    Victim adds and refreshes repo as root
  4. Execution
    libzypp resolves traversal outside repo root
  5. Persist
    Overwrite sensitive system file
  6. Impact
    DoS or root privilege escalation

Vulnerability Assessment

Weakness
CWE
CWE-23
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Relative path traversal prevention
Exploitation Conditions

Exploitation requires the victim to add and refresh/use an attacker-controlled (or MITM-intercepted) zypper repository, and the malicious repomd.xml or SUSE-tags content file must contain a location href, descrdir/datadir, or HASH entry using relative '../' path components that resolve outside the repository root. The operation that downloads/writes the file must be performed with sufficient privileges (typically root via zypper) for the overwrite to reach sensitive paths and achieve privilege escalation. Limiting factors: per CVSS PR:N the attacker needs no authentication, but UI:R means a user action (configuring/refreshing the repo) is mandatory; enforcement of repository GPG signing and HTTPS substantially constrains the ability to deliver malicious metadata; affected only on libzypp versions before 17.38.10.
Impact

The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) reflects network delivery with low complexity, no attacker privileges, but mandatory user interaction - the victim must configure and refresh the malicious repository. The realistic risk is gated by that UI:R: an attacker must convince a target to trust and refresh an attacker-controlled or man-in-the-middle'd repo, which is a meaningful barrier outside of supply-chain or unsigned-mirror scenarios. No EPSS score, KEV entry, or POC was provided in the input, so exploitation probability cannot be quantified from the data; the absence of KEV/POC suggests this is currently a theoretical-but-serious issue rather than one under active mass exploitation. One signal to verify: the vector rates C:H, but the described impact is file overwrite (integrity) and DoS (availability) leading to privilege escalation - high confidentiality impact is justified only via the resulting code execution as root, not by direct data disclosure, so treat C:H as a downstream consequence of privesc rather than a primary effect.
Exploit ScenarioDerived

An attacker hosts (or man-in-the-middles) a repository and publishes a repomd.xml or content file containing a <location href="../../etc/..."> style entry. When a victim adds that repository and runs a refresh/install as root, libzypp resolves the traversal path and overwrites a sensitive system file, enabling denial of service or planting attacker-controlled content that yields root-level privilege escalation. No public exploit is identified at time of analysis, but the fix's test fixture (repomd-1.xml with a 'hostile' '../hostile/to_be_discarded' location) illustrates the exact trigger.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 29, 2026

Arbitrary file overwrite in libzypp before 17.38.10 lets a remote attacker who controls a software repository plant crafted repository metadata (repomd/SUSE content files) with '../' location paths that escape the repo root, allowing files anywhere on the system to be overwritten when a victim adds and refreshes that repository. Because zypper-based refresh operations typically run as root, this can escalate to privilege escalation or denial of service. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

RemediationAI

Vendor-released patch: 17.38.10 - upgrade libzypp to 17.38.10 or later via your SUSE/openSUSE update channel as the primary fix (commit f09feda7fca03c941218aab0bb161cc82b185b6b adds path sanitization that discards metadata entries resolving outside the repo root). Until patched, the most effective compensating control is to only add and refresh repositories from trusted, vendor-signed sources and to enforce repository GPG signature checking and HTTPS transport so attacker-supplied or MITM'd metadata cannot be introduced (trade-off: blocks use of unsigned/internal mirrors and may break workflows relying on plain-HTTP mirrors). Avoid running 'zypper refresh/install' against untrusted third-party repositories, and where feasible restrict which accounts/automation can modify the repository list (trade-off: tighter change control on repo configuration). Track the SUSE advisory at https://bugzilla.suse.com/show_bug.cgi?id=1259802 for distribution-specific fixed package versions.

Affected VersionsENISA

libzypp 0 <17.38.10

Affected Packages

euvd libzypp fix: 17.38.10

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libzypp is the C++ package-management library underpinning zypper and the SUSE/openSUSE software stack (YaST, PackageKit backends). The flaw is a CWE-23 relative path traversal in the metadata parsers: RepomdFileReader.cc (YUM 'repomd.xml' <location href> attributes) and susetags/ContentFileReader.cc (descrdir/datadir directives and per-file HASH entries). These parsers took attacker-supplied href/path values and used them verbatim to compute download/storage locations, so a value like '../hostile/...' resolved to a path outside the repository cache. The vendor fix introduces sanitize()/sanitizeEntry() helpers that call Pathname::absolutename() and Pathname::relativeDotDot() to detect and discard entries that point outside the repo root, logging a 'hostile location' warning instead of writing the file.

Know when Libzypp gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (suse) PRIMARY 8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI 8.8 HIGH

Network-delivered metadata (AV:N) with no attacker auth (PR:N) but mandatory victim repo refresh (UI:R); root-privileged file overwrite yields privesc, so I:H/A:H and C:H via resulting code execution.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 7.4 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat 8.8 HIGH

Primary rating from Vendor (suse).

CVSS VectorVendor: suse

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
Patch available
Jun 29, 2026 - 12:01 EUVD

DescriptionCVE.org

A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories to overwrite files on the system, leading to denial of service or privilege escalation.

Executive ViewAI

Why It Matters

libzypp (SUSE's package management library) contains a critical file overwrite vulnerability that could allow attackers controlling malicious repositories to modify arbitrary system files with root privileges. Organizations running SUSE Linux systems face risk of complete infrastructure compromise or denial of service if administrators add compromised repositories. This vulnerability directly threatens operational continuity and data security across affected Linux deployments.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Permit only SUSE-authorized repositories; (2) Require administrative review and audit logging for all repository configuration changes; (3) Disable automatic repository refresh and require manual approval before execution; (4) Implement mandatory cryptographic signature verification on repository metadata; (5) Deploy file integrity monitoring to detect unauthorized system file modifications; (6) Run package management operations with reduced privileges where technically feasible.

Threat Intelligence Overview

EPSS Score
0.6%
Top 55% exploitable
Prevalence
Medium
core package library across all SUSE/openSUSE systems, smaller global footprint
Social Media
2
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.6%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

45
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Path Traversal HIGH

Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Libzypp

View all
CVE-2026-44941 HIGH
8.8 Jul 02

Arbitrary root file write in libzypp before 17.38.12 lets an attacker who can get a victim to add or refresh a malicious
CVE-2018-7685 HIGH
7.8 Aug 31

The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the c
CVE-2026-44942 MEDIUM
6.5 Jun 18

Path traversal in libzypp's .repo file processing enables low-privileged network-accessible attackers to write content i
CVE-2013-3704 MEDIUM
4.3 Oct 28

The RPM GPG key import and handling feature in libzypp 12.15.0 and earlier reports a different key fingerprint than the

Same weakness CWE-23 – Relative Path Traversal

View all
CVE-2025-64446 CRITICAL POC
9.8
CVE-2024-27199 HIGH POC
7.3
CVE-2025-34510 HIGH POC
8.8
CVE-2026-76519 CRITICAL POC
9.8
CVE-2026-34926 MEDIUM POC
6.7
CVE-2024-24578 CRITICAL POC
9.8
CVE-2025-52207 CRITICAL POC
9.9
CVE-2023-6825 CRITICAL POC
9.9

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/ltss/sle15.4/sle15:15.4-6.29 Container suse/manager/4.3/proxy-httpd:4.3.18.9.79.16 Container suse/manager/4.3/proxy-salt-broker:4.3.18.9.69.16 Container suse/sle-micro-rancher/5.3:latest Container suse/sle-micro-rancher/5.4:5.4.4.5.138 Container suse/sle-micro/5.3/toolbox:16.3-6.11.242 Container suse/sle-micro/5.4/toolbox:16.3-5.19.243 Image SLES15-SP4-CHOST-BYOS Image SLES15-SP4-CHOST-BYOS-Aliyun Image SLES15-SP4-CHOST-BYOS-Azure Image SLES15-SP4-CHOST-BYOS-EC2 Image SLES15-SP4-CHOST-BYOS-GCE Image SLES15-SP4-CHOST-BYOS-SAP-CCloud Affected
Container suse/ltss/sle15.5/sle15:15.5-8.46 Container suse/sle-micro/5.5/toolbox:16.3-3.12.150 Container suse/sle-micro/base-5.5:2.0.4-5.8.285 Affected
Container suse/ltss/sle15.6/sle15:15.6-5.66 Affected
Container suse/multi-linux-manager/5.1/x86_64/proxy-httpd:5.1.4.8.24.2 Container suse/multi-linux-manager/5.1/x86_64/proxy-salt-broker:5.1.4.9.22.2 Container suse/sle15:15.7-5.20.31 Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2-ECS-HVM Affected
Container suse/multi-linux-manager/5.1/x86_64/server-saline:5.1.4.9.22.1 Image proxy-salt-broker-image Image server-saline-image Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-25707 ADVISORY https://vuldb.com/vuln/374608 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21988/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21992/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22172/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22221/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2531/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2575/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2590/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2628/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2674/ REF https://bugzilla.suse.com/show_bug.cgi?id=1259802 REF https://github.com/openSUSE/libzypp/commit/f09feda7fca03c941218aab0bb161cc82b185b6b

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy