CVE-2026-25707 Handcrafted repo metadata may cause arbitrary local files to be overwritten by libzypp
Remote attackers can overwrite local files via malicious repository metadata in libzypp, potentially causing denial of service or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-25707?
CVE-2026-25707 is a high-severity path traversal vulnerability in SUSE libzypp, published on 29 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories to overwrite files on the system, leading to denial of service or privilege escalation.
Weakness: CWE-23
Which versions are affected by CVE-2026-25707?
It affects 1 product.
Linux distribution packages (1)
libzypp openSUSE:Tumbleweed | All versions | 17.38.10-1.1 |
Products include Opensuse Libzypp.
How do I fix CVE-2026-25707?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-25707 being exploited?
There is no known exploitation of CVE-2026-25707 in the wild and no public exploit code.
Other vulnerabilities in SUSE libzypp
- CVE-2026-44941 libzypp path traversal via "keyhint" in repomd.xml
- CVE-2017-7435 libzypp accepts unsigned 3rd party repo without warning
- CVE-2017-7436 libzypp accepts unsigned packages even when configured to check signatures
- CVE-2018-7685 libzypp does not reevaluate malicious rpms once downloaded
- CVE-2017-9269 lack of keypinning in libzypp could lead to repository switching
Sources
Also known as DEBIAN-CVE-2026-25707, GHSA-4h5m-3w75-qcq5, UBUNTU-CVE-2026-25707, openSUSE-SU-2026:10896-1.