Executive brief
libzypp is a core library used for software management in SUSE and openSUSE Linux distributions. A vulnerability exists where a malicious software repository can trick the system into overwriting critical system files during the update process. This could allow an attacker to gain administrative control over the system or cause a complete service outage by corrupting essential configuration files.
Technical details
A relative path traversal vulnerability (CWE-23) exists in libzypp's handling of repository metadata. When processing 'primary.xml' or other metadata files, the library concatenates the local cache root with the 'location href' attribute provided by the remote repository. By using 'href' values containing '../' sequences, a malicious repository can escape the intended cache directory and write files to arbitrary locations on the filesystem. This can lead to privilege escalation (e.g., by overwriting /etc/passwd) or denial of service. The vulnerability is exploitable if a user is convinced to add a malicious repository or if a trusted repository is compromised. A fix is available in libzypp version 17.38.10 and later, which implements path validation to discard entries pointing outside the repository's local cache.
Affected products
- SUSE libzypp before 17.38.10
Timeline
- 2026-03-18: disclosed: Initial report in SUSE Bugzilla
- 2026-05-27: patched: Fixes submitted to GitHub repository
- 2026-06-05: advisory: SUSE security update announcements released
- 2026-06-29: disclosed: CVE published to NVD