# CVE-2026-25707: SUSE libzypp path traversal in repository metadata processing

Source: https://junglewise.ai/threats/cve-2026-25707-suse-libzypp-path-traversal-in-repository-metadata-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-29. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2026-25707 · Severity: high · CVSS 8.8 · Published 2026-06-29

libzypp is a core library used for software management in SUSE and openSUSE Linux distributions. A vulnerability exists where a malicious software repository can trick the system into overwriting critical system files during the update process. This could allow an attacker to gain administrative control over the system or cause a complete service outage by corrupting essential configuration files.

Technologies: [Suse Libzypp](https://junglewise.ai/threats/technologies/libzypp). Vendors: [Suse](https://junglewise.ai/threats/vendors/suse).

## Quick answers

**Is CVE-2026-25707 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25707 being exploited in the wild.

**How severe is CVE-2026-25707?** High severity, with a CVSS score of 8.8, published 29 June 2026.

**Which products and versions are affected?** Suse Libzypp before 17.38.10.

**Is there a fix for CVE-2026-25707?** A patch was published on 2026-05-27: Fixes submitted to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25707 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-25707?** Check whether you run Suse Libzypp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A relative path traversal vulnerability (CWE-23) exists in libzypp's handling of repository metadata. When processing 'primary.xml' or other metadata files, the library concatenates the local cache root with the 'location href' attribute provided by the remote repository. By using 'href' values containing '../' sequences, a malicious repository can escape the intended cache directory and write files to arbitrary locations on the filesystem. This can lead to privilege escalation (e.g., by overwriting /etc/passwd) or denial of service. The vulnerability is exploitable if a user is convinced to add a malicious repository or if a trusted repository is compromised. A fix is available in libzypp version 17.38.10 and later, which implements path validation to discard entries pointing outside the repository's local cache.

## Affected products

- SUSE libzypp before 17.38.10

## Timeline

- 2026-03-18: disclosed: Initial report in SUSE Bugzilla
- 2026-05-27: patched: Fixes submitted to GitHub repository
- 2026-06-05: advisory: SUSE security update announcements released
- 2026-06-29: disclosed: CVE published to NVD

## References

- [https://bugzilla.suse.com/show_bug.cgi?id=1259802](https://bugzilla.suse.com/show_bug.cgi?id=1259802)
- [https://github.com/openSUSE/libzypp/commit/f09feda7fca03c941218aab0bb161cc82b185b6b](https://github.com/openSUSE/libzypp/commit/f09feda7fca03c941218aab0bb161cc82b185b6b)

## Related threats

- [SUSE libzypp path traversal in repomd.xml keyhint parsing](https://junglewise.ai/threats/cve-2026-44941-suse-libzypp-path-traversal-in-repomd-xml-keyhint-parsing)
- [SUSE libzypp path traversal in .repo file parsing](https://junglewise.ai/threats/cve-2026-44942-suse-libzypp-path-traversal-in-repo-file-parsing)