CVE-2026-25707

A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories to overwrite files on the system, leading to denial of service or privilege escalation.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://bugzilla.suse.com/show_bug.cgi?id=1259802	Issue Tracking
https://github.com/openSUSE/libzypp/commit/f09feda7fca03c941218aab0bb161cc82b185b6b	Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:opensuse:libzypp:*:*:*:*:*:*:*:*

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Un error de salto de ruta relativo al procesar metadatos del repositorio en libzypp anterior a la versión 17.38.10 podría ser utilizado por atacantes remotos que suministran repositorios para sobrescribir archivos en el sistema, lo que lleva a denegación de servicio o escalada de privilegios.

Information

Published : 2026-06-29 10:16

Updated : 2026-10-25 17:10

NVD link : CVE-2026-25707

Mitre link : CVE-2026-25707

CVE.ORG link : CVE-2026-25707

JSON object : View

Products Affected

opensuse

libzypp

CWE

CWE-23

Relative Path Traversal

{"id": "CVE-2026-25707", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25707", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-29T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "meissner@suse.de", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "meissner@suse.de", "affectedData": [{"repo": "https://github.com/openSUSE/libzypp", "vendor": "SUSE", "product": "libzypp", "versions": [{"status": "affected", "version": "0", "lessThan": "17.38.10", "versionType": "rpm"}], "packageName": "libzypp", "defaultStatus": "unaffected"}]}], "published": "2026-06-29T10:16:30.330", "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=1259802", "tags": ["Issue Tracking"], "source": "meissner@suse.de"}, {"url": "https://github.com/openSUSE/libzypp/commit/f09feda7fca03c941218aab0bb161cc82b185b6b", "tags": ["Patch"], "source": "meissner@suse.de"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "meissner@suse.de", "description": [{"lang": "en", "value": "CWE-23"}]}], "descriptions": [{"lang": "en", "value": "A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories to overwrite files on the system, leading to denial of service or privilege escalation."}, {"lang": "es", "value": "Un error de salto de ruta relativo al procesar metadatos del repositorio en libzypp anterior a la versi\u00f3n 17.38.10 podr\u00eda ser utilizado por atacantes remotos que suministran repositorios para sobrescribir archivos en el sistema, lo que lleva a denegaci\u00f3n de servicio o escalada de privilegios."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opensuse:libzypp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9EFF54E0-0659-4D9F-805E-6AC45DBFE950", "versionEndExcluding": "17.38.10"}], "operator": "OR"}]}], "sourceIdentifier": "meissner@suse.de"}